The real reason for large DDoS attacks? It's IP Spoofing, not memcached

Re:The real reason for large DDoS attacks? It's IP Spoofing,... by betaby on Thursday March 08, 2018 @06:47PM (#16548739)

Your incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.

[ Parent | on HN ]

Re:The real reason for large DDoS attacks? It's IP Spoofing,... by grahamburger on Friday March 09, 2018 @02:20PM (#16554158)

As someone who has been doing 'shoestring independent ISPs' for almost 15 years my impression is that nearly all upstream providers (the ones we buy service from - not always but sometimes tier 1 providers) do outgoing IP filtering. Whenever I get a new IPv4 allocation from ARIN (at least when we used to be able to do that - they're all gone now) we had to go through a process with our upstream provider so that they would allow our BGP advertisements for that block as well as allow those source addresses to route through their network.

[ Parent | on HN ]

Re:The real reason for large DDoS attacks? It's IP Spoofing,... by sathackr on Saturday March 10, 2018 @02:08AM (#16557506)

They may filter what routes you can advertise via BGP, but nearly every Tier 1(And most Tier 2) providers will accept traffic sourced from any IP address. I handle about 10 different connections and can source traffic from any IP on all of them.

[ Parent | on HN ]

Re:The real reason for large DDoS attacks? It's IP Spoofing,... by walterkobayashi on Thursday March 08, 2018 @07:42PM (#16548996)

75% ISP's in Europe don't do IP Filtering.

[ Parent | on HN ]

Re:The real reason for large DDoS attacks? It's IP Spoofing,... by citrin_ru on Friday March 09, 2018 @09:56AM (#16552112)

According to CAIDA statistics much less that 75% don't filter. See map: https://spoofer.caida.org/summary.php

[ Parent | on HN ]