<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
Fred Morris wrote:
<blockquote cite="mid:Pine.LNX.4.53.1303311221440.20798@flame.m3047.net"
type="cite">
<pre wrap="">I'm sure this must have been discussed at some point, somewhere.</pre>
</blockquote>
<br>
yes.<br>
<br>
<blockquote cite="mid:Pine.LNX.4.53.1303311221440.20798@flame.m3047.net"
type="cite">
<pre wrap="">...
BCP38 filtering on egress from the network is ineffective in such
scenarios because it is based on the assumption that the spoofed packets
are coming in from outside the network (and hence originated as egress
from someone else's network).</pre>
</blockquote>
<br>
no.<span style="font-family: monospace;"> in
<a class="moz-txt-link-rfc2396E" href="http://archive.icann.org/en/committees/security/sac004.txt"><http://archive.icann.org/en/committees/security/sac004.txt></a> there
is a definition of "edge" in terms of source address repudiability.
what this means is, the time to drop a packet because its source address
makes no sense is, at the point where it is about to stop making sense.
that means on the customer-facing interface, no matter whether that
customer is on a WAN or LAN. see also section 5.1 describing the
multihoming corner case whereby some customers (but not by default!) can
emit packets with source addresses other than those you've assigned to
them.<br>
<br>
paul<br>
<br>
PS. amazingly, only three people so far in 2013 have told me in the
strongest possible terms that ip source address spoofing is no longer
happening and that i should stop worrying so much about it. i'm grateful
to all of the ddos actors whose well-publicized ip spoofing successes
in the last year have made those strange discussions a ~monthly rather
than a ~weekly event in my life of late. --pv<br>
</span></body></html>