[60312] in North American Network Operators' Group
Re: WANTED: ISPs with DDoS defense solutions
daemon@ATHENA.MIT.EDU (Jack Bates)
Wed Aug 6 11:52:03 2003
Date: Wed, 06 Aug 2003 10:51:23 -0500
From: Jack Bates <jbates@brightok.net>
To: nanog@merit.edu
In-Reply-To: <OF31DC8423.9C832EF5-ON80256D7A.0030A520-80256D7A.0032D739@radianz.com>
Errors-To: owner-nanog-outgoing@merit.edu
Michael.Dillon@radianz.com wrote:
>
> If the client is behind a NAT, and the spoofed source address doesn't get
> through, then that's OK because it means that no application in that same
> location behind the NAT can use spoofed addresses.
>
Which is important given the number of NAT setups that only perform NAT
for the ranges they deal with and leave everything else alone. NATing
all traffic may not be ideal in some cases, but filtering traffic that
isn't desired is critical. Establishing an initial connection is, of
course, necessary so that the server recognizes what the source address
should be.
-Jack
