[8142] in North American Network Operators' Group
Re: How to protect registered IP addresses
daemon@ATHENA.MIT.EDU (Chris Cook, Net Asset LLC)
Thu Mar 13 05:21:10 1997
X-Real-To: <nanog@merit.edu>
From: chris@netasset.com (Chris Cook, Net Asset LLC)
Date: Wed, 12 Mar 1997 19:19:58 -0700
Cc: nanog@merit.edu
On Thu, Mar 13, 1997, 3:39:29 AM PST George Herbert wrote:
>
>I believe you can just deny by default and allow traffic from the
>registered address blocks under each interface, on incoming interfaces
>at your central router (and sub-routers). Nice short list.
>
>-george william herbert
>gherbert@crl.com
>
This is obviously better then nothing, and probably the most practical
solution, but most networks have holes in their allocated blocks.
Wouldn't some sort of authentication scheme (RADIUS/TACACS
or maybe Kerbros) be a better solution? More complicated for sure.
The idea would be to check the connection request to the outgoing router
against some sort of database, then expiring the token after it's use. The
real trick to this is checking only the initial request. Something more in the
realm of switching authentication...
Anyone have any ideas how something as large as a class B with say 30% address
utilization on scattered addresses (non-contigeous) could be rapidly verified
without checking every packet?
Thanks for your indulgance,
Chris Cook
Network Engineer
__________________________________________________________________________
Net Asset Network Operations Center
1315 Van Ness Ave., Suite 103
Fresno CA 93721
209/225-0222
