nanog mailing list archives
Re: icmp rpf
From: "william(at)elan.net" <william () elan net>
Date: Mon, 25 Sep 2006 11:47:44 -0700 (PDT)
On Mon, 25 Sep 2006, Chris Adams wrote:
Once upon a time, Mark Kent <mark () noc mainstreet net> said:I think this is an important point to make because of my interaction with small.net. When I pointed out the timeouts they said that it was because they don't announce the router IP addresses, which is true but not the whole story. I mentioned that some providers in the past numbered on rfc1918 space and traceroute still worked, so that alone was not enough.Not announcing their router interface IP space is not any type of security. Anyone directly connected to them (customer or peer) could if they wish statically route that IP space, and any such security would be gone. Unless it is otherwise filtered, any customer with a default route can reach their routers.
Nevertheless putting router interface ip address for your network in one specific block is very effective as way to quickly get ridof DoS attack on the router - you simply stop announcing that block but everything else on the network still works. And doing
tricks like having primary ip address which not important at all (except for logging traffic actually destined to it) while secondary ip on the same interface is really the one used for inter-connection also works quite well. -- William Leibzon Elan Networks william () elan net
Current thread:
- icmp rpf Mark Kent (Sep 24)
- Re: icmp rpf Mark Smith (Sep 24)
- Re: icmp rpf Michael . Dillon (Sep 25)
- Re: icmp rpf virendra rode // (Sep 24)
- Re: icmp rpf Mark Kent (Sep 24)
- Re: icmp rpf Roland Dobbins (Sep 24)
- Re: icmp rpf virendra rode // (Sep 24)
- Re: icmp rpf Mark Smith (Sep 25)
- Re: icmp rpf Mark Kent (Sep 25)
- Re: icmp rpf Chris Adams (Sep 25)
- Re: icmp rpf william(at)elan.net (Sep 25)
- Re: icmp rpf Tony Rall (Sep 26)
- Re: icmp rpf Jared Mauch (Sep 26)
- Re: icmp rpf Mark Kent (Sep 24)
- Re: icmp rpf Bill Stewart (Sep 27)
- Re: icmp rpf Mark Smith (Sep 24)
- Re: icmp rpf Adrian Chadd (Sep 25)
- New router feature - icmp error source-interface [was: icmp rpf] Patrick W. Gilmore (Sep 25)
- Re: New router feature - icmp error source-interface [was: icmp rpf] Joe Maimon (Sep 25)
- Re: New router feature - icmp error source-interface [was: icmp rpf] Mark Smith (Sep 25)
- RE: New router feature - icmp error source-interface [was: icmp rpf] Berkman, Scott (Sep 25)