Filtering Spoofed Packets

Network Ingress Filtering

(BCP 38)

What are spoofed or forged packets?

Why are they bad?

How to keep them out

A typical connection from an ISP to a customer

ISP border router

Customer border router

Customer Network

Default route to

border router

Default route to ISP

Route customer network

to customer router

Packets from ISP:

IP src = anything

IP dst = customer

Packets from customer:

IP src = customer

IP dst = anything

The Problem

Attackers gain control of thousands or millions of hosts

Worm or virus infection

Bot nets

Hosts send forged packets

IP source = forgery (random or victim)

IP destination = victim

Forged packets go to victims

DNS request, TCP SYN, etc.

Responses go to random places or other victims

DNS response, TCP ACK/RST, ICMP, etc.

Forged packets cause traffic to victims

ISP border router

Customer border router

Customer Network

2: Packets from

customer:

IP src = victim2

IP dst = victim1

PC with virus

or controlled by attacker

1: Forgery

from attacker:

IP src = victim2

IP dst = victim1

4: Replies from

victim1 go

to victim2

3: Packets from ISP

to victim1:

IP src = victim2

IP dst = victim1

Victim 1

Victim 2

Amplification: multiple forgery sources in the same ISP

Customer border router

Customer Network

PC with virus

or controlled by attacker

Victim 1

Victim 2

Customer border router

Customer Network

ISP border router

Traffic to ISP, victim1, and victim2, all amplified

Amplification: multiple forgery sources in different ISPs

Customer border router

Customer Network

PC with virus

or controlled by attacker

Victim 1

Victim 2

Customer border router

Customer Network

ISP border router

ISP border router

Traffic to victim1, and victim2 amplified. Traffic to ISP not amplified.

Amplification: multiple “victim 1”, single “victim 2”

Customer border router

Customer Network

PC with virus

or controlled by attacker

Victim 1

Victim 2

Customer border router

Customer Network

ISP border router

ISP border router

Victim 1

Traffic to victim2 amplified. Traffic to ISP and victim1 not amplified.

“Denial of Service” (DoS) attacks

The attacker wants to cause some service to stop working for some victim

Attacker controls many hosts

Attacker instructs hosts to send forged packets to victim

Victim gets lots of packets from many sources

Distributed Denial of Service (DDoS)

Difficult for victim to filter effectively when packets have forged source addresses

Ingress filtering

ISPs can block the forged packets as they transit from the customer network to the ISP border router

ISP knows what IP addresses the customer is allowed to use

ISP can therefore block packets with source IP addresses outside the range that the customer is allowed to use

This will prevent the attack

Why use Ingress Filtering

Save bandwidth from ISP to victims by not forwarding forged packets

If you don't send forged packets, you won't be contacted by investigators

If you send forged packets, you may eventually be blacklisted by other ISPs

When your customers are the victms, you will wish that other ISPs had blocked the attack

Simple case: Single-homed customer

If the customer is single-homed, then the only addresses they are allowed to use are the addresses that the ISP routes to them

ISP can easily configure the border router to block all other addresses

Cisco feature:

interface Serial1/2

ip verify unicast reverse-path

Complex case: Multi-homed customer

If the customer is multi-homed, then they may also use addresses from other ISPs

e.g. Satellite downlink from ISP A, uplink to ISP B

ISPs can still block the forged packets

Need to have a list of valid addresses

Use generic filtering features, such as cisco access lists

Not just one trivial command, but still worth doing

Further Reading

BCP 38 (RFC 2827)

http://www.ietf.org/rfc/rfc2827.txt

Team Cymru

http://www.cymru.com/

A few presentations

http://bgphints.ruud.org/articles/urpf.html

http://www.nanog.org/mtg-0602/pdf/greene.ppt

http://www.cisco.com/warp/public/ 732/Tech/security/docs/urpf.pdf

AfNOG 2007 E2 - Filtering spoofed packets

Originally for AfNOG 2006
Updated for AfNOG 2007

2006-05-06T16:11:27