North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: Automatic filtering - CISCO, you should think about this...
- From: Phil Howard
- Date: Sun Dec 28 14:23:43 1997
Karl Denninger writes...
> How about an interface keyword such as "auto-inbound-filter", which does
> At STARTUP and when the LOCAL route table changes (ie: "ip route
> xxx..." statements) the system looks at the interfaces, and the
> local static routes, and builds an accept list for that interface.
> The list is stored in a "reserved" set of system access lists.
> Add a parmaeter which can be turned on (ie: log) which would add
> "log" to the end of the filter lists, so that anyone TRYING to smurf
> will get logged
> This would totally automate the process of inbound filtering to prevent or
> severely limit smurf attacks.
> Since filters which are based only on the source address are relatively
> cheap for the router to process, this would likely not seriously burden
> anyone in their direct connections.
> I'd love to see something like this, and it would reduce the complaint that
> its "too hard to manage" such things.
How about having "no-auto-inbound-filter" instead, making the default in all
new versions of IOS be to run this essential level of protection, providing
a means to turn it off only for those who know they need to turn it off.
Phil Howard | email@example.com firstname.lastname@example.org email@example.com
phil | firstname.lastname@example.org email@example.com firstname.lastname@example.org
at | email@example.com firstname.lastname@example.org email@example.com
milepost | firstname.lastname@example.org email@example.com firstname.lastname@example.org
dot | email@example.com firstname.lastname@example.org email@example.com
com | firstname.lastname@example.org email@example.com firstname.lastname@example.org