Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Blocking spoofing at the source (was: ICMP Attacks??)

  • From: Robert Sanders
  • Date: Fri Aug 29 18:51:11 1997

Phil Howard <phil@charon.milepost.com> writes:

> As long as _one_ _of_ _the_ _routes_ would go back on the interface the
> packet arrived on, not necessarily the best route, then the logic would
> work in the majority of cases that I know of.
> 
> But this could require a more extensive route lookup, which would do more
> than just double the CPU time looking up routes.

Not necessarily.  For routers at the very edge of the network, each
interface probably has a small and fairly static set of route
candidates through it.  The router could automatically update a magic
IP traffic filter that's updated whenever the set of routes through
the interface changes.  This, possibly coupled with some aggressive
aggregation, is for most cases a Simple Matter Of Programming that
wouldn't significantly impact router performance.  Even at the core,
the cost of updating filter lists due to route flap has to be much,
much less than the cost of doubling (or worse) the number of route
table lookups per packet forwarded.

regards,
  -- Robert




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.