[lacnog] DDoS, ataques de amplificacion y BCP38

[Arturo Servin]

	O poner una ACL en tu router de border con:

	acl bcp38
	ip permit my_/24
	ip permit my_other/24
	ip deny all

	int to_my_transit_provider
	  acl bcp38 out

	
	Y claro, del lado del otra lado tambien se puede en la mayoria de los
casos:

	acl bcp38
	ip permit my_customer_/24
	ip permit my_customer_other/24
	ip deny all

	int to_my_customer
	  acl bcp38 in

	Y el mundo seria otro ...

Slds
as

	

On 3/27/13 5:27 PM, Carlos M. Martinez wrote:
> El tema de los open resolvers es increible... como algo tan facil de
> corregir es completamente ignorado por la gente.
> 
> ¿Que nos pasa?
> 
> s2
> 
> ~C.
> 
> On 3/27/13 5:23 PM, Hugo Salgado wrote:
>> Además, cerrar los DNS recursivos solo a los clientes; y aplicar
>> RRL a los autoritativos.
>>
>> Saludos,
>>
>> Hugo
>>
>> On 03/27/2013 05:16 PM, Arturo Servin wrote:
>>> 	Hay una discusion interesante sobre DDoS, ataques de amplificacion y
>>> BCP38 en la lista de nanog.
>>>
>>> 	De ahi este par de articulos (sobre DDoS de mas de 100 Gbps) que nos
>>> dice lo importante de aplicar el BCP38 a nuestras redes:
>>>
>>> New York Times
>>> http://www.nytimes.com/2013/03/27/technology/internet/online-dispute-becomes-internet-snarling-attack.html
>>>
>>> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
>>>
>>>
>>> 	Espero que en estas listas la mayoria se asegure que el trafico que
>>> sale de sus redes y de sus clientes no sea de direcciones de IP "spoofeadas"
>>>
>>> Extracto del articulo del NY Times:
>>>
>>> "The heart of the problem, according to several Internet engineers, is
>>> that many large Internet service providers have not set up their
>>> networks to make sure that traffic leaving their networks is actually
>>> coming from their own users. The potential security flaw has long been
>>> known by Internet security specialists, but it has only recently been
>>> exploited in a way that threatens the Internet infrastructure."
>>>
>>> Slds
>>> as
>>> _______________________________________________
>>> LACNOG mailing list
>>> LACNOG en lacnic.net
>>> https://mail.lacnic.net/mailman/listinfo/lacnog
>>> Cancelar suscripcion: lacnog-unsubscribe en lacnic.net
>>>
>> _______________________________________________
>> LACNOG mailing list
>> LACNOG en lacnic.net
>> https://mail.lacnic.net/mailman/listinfo/lacnog
>> Cancelar suscripcion: lacnog-unsubscribe en lacnic.net
> 
> _______________________________________________
> LACNOG mailing list
> LACNOG en lacnic.net
> https://mail.lacnic.net/mailman/listinfo/lacnog
> Cancelar suscripcion: lacnog-unsubscribe en lacnic.net
>