bk99.de entertain the web since 1997

bk99.de
RFC · SecurityStandard explained

RFC 2827: Ingress filtering against spoofed source addresses

Summary

RFC 2827 recommends that providers drop packets with implausible source addresses at the point of entry. Abuse protection works best close to the source. Global security depends on many local operational decisions.

Ideas

  • Network edges know the expected source prefixes of their customers.
  • Filters make source address spoofing harder.
  • Less spoofing reduces reflected DDoS attacks.

Facts

  • RFC 2827 replaces RFC 2267.

Remarks

  • RFC 2827 has the status “Best Current Practice”; current errata and successor documents should also be checked.

Recommendations

  • Enable BCP 38 filters at customer and site borders.
  • Consider asymmetric paths when applying strict checks.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2010

RFC 5961: Hardening TCP against blind reset and SYN attacks

RFC 5961 improves TCP checks so that spoofed segments find it harder to reset or disrupt existing connections. Small state checks can greatly increase the cost of an attack. Old protocols stay robust through targeted, compatible fixes.

RFC · 2014

RFC 7258: Pervasive monitoring is an attack

RFC 7258 explicitly declares large-scale passive monitoring a form of attack that protocol design must take into account. Threat models have to include powerful global observers. Encryption by default changes privacy for the whole network.

RFC · 2004

RFC 3711: SRTP: Confidential real-time media

RFC 3711 adds encryption, integrity and replay protection for audio and video streams to RTP. Real-time security must combine low delay with effective protection. Key management remains a central task outside the media format.