News for hackers. Stuff that matters.

A comment on Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS. Parent comment

Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by sebcat on Thursday June 29, 2017 @03:00AM (#14661327)
In this case, you don't have to care about UDP or TCP, only IP.

RFC2827, which should fix the problem where SSDP can be used for DDoS, was published in 2000: https://tools.ietf.org/html/rfc2827

Is ingress filtering on layer 3 considered DPI?

[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by mjevans on Thursday June 29, 2017 @03:35AM (#14661452)
I am not this kind of network engineer, HOWEVER. Both IPv4 and IPv6 are versioned by the first 4 bits of the packet. Depending on that value the address size and location are fixed.

I would not consider the comparison of the source address of packets crossing an ingress link to be 'deep'. I consider that check to be very shallow. It needn't even be every packet from a set, merely picking a random (actually random) packet and testing for conformity is a good quality control measure that SHOULD be taken.

What would the comparison be against? Routers are supposed to know which links are on the other side of all down-stream connections so that they can effectively route.

[ Parent | on HN ]