[164897] in North American Network Operators' Group
Re: Spoofing ASNs (Re: SNMP DDoS: the vulnerability you might not
daemon@ATHENA.MIT.EDU (Jared Mauch)
Thu Aug 8 13:45:07 2013
From: Jared Mauch <jared@puck.nether.net>
In-Reply-To: <CAEmG1=o_E5K3n8MjmovCE7c2GsYELHX1fb_bsgKQZHFYt_E1oQ@mail.gmail.com>
Date: Thu, 8 Aug 2013 13:45:03 -0400
To: Matthew Petach <mpetach@netflight.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Aug 8, 2013, at 1:40 PM, Matthew Petach <mpetach@netflight.com> =
wrote:
>=20
>=20
> On Thu, Aug 8, 2013 at 10:29 AM, Jared Mauch <jared@puck.nether.net> =
wrote:
>=20
> On Aug 1, 2013, at 2:31 AM, Saku Ytti <saku@ytti.fi> wrote:
>=20
> > On (2013-07-31 17:07 -0700), bottiger wrote:
> >
> >> But realistically those 2 problems are not going to be solved any =
time
> >> in the next decade. I have tested 7 large hosting networks only one =
of
> >> them had BCP38.
> >
> > I wonder if it's truly that unrealistic. If we target access =
networks, it
> > seems impractical target.
> >
> > We have about 40k origin only ASNs and about 7k ASNs which offer =
transit,
> > who could arguably trivially ACL those 40k peers.
> >
> > If we truly tried, as a community to make deploying these ACLs easy =
and
> > actively reach out those 7k ASNs and offer help, would it be =
unrealistic to
> > have ACL deployed to sufficiently large portion of networks to make
> > spoofing impractical/expensive?
>=20
> The following is a sorted list from worst to best of networks that =
allow spoofing: (cutoff here is 25k)
>=20
> (full list - =
http://openresolverproject.org/full-spoofer-asn-list-201307.txt )
>=20
> =20
> Count ASN#
> ------------
> 1323950 3462
> 1300938 4134
> 1270046 8151
> 1213972 9737
> ...
>=20
> For the technically clueless among us...
>=20
> what does "count" refer to in this output?
> How many times you were able to spoof
> an address through them? How many
> different addresses you could spoof through
> them? How many spoofed packets made it
> through before being blocked?
>=20
> It's kinda hard to know what the list
> represents without a bit of explanation
> around it. ^_^;
Number of unique IPs that spoofed a packet to me. (eg: I sent a packet =
to 1.2.3.4 and 5.6.7.8 responded).
If those ASNs are downstream to you, or you are part of that ASN, you =
can ask for a list of the IPs involved.
Either way, if you have 1.2 million hosts, it may be a lot of BCP38 you =
need to apply.
- Jared=
