{"id":28912,"date":"2014-07-18T19:26:11","date_gmt":"2014-07-18T19:26:11","guid":{"rendered":"http:\/\/www.internetsociety.org\/deploy360\/anti-spoofing\/"},"modified":"2025-08-06T14:29:22","modified_gmt":"2025-08-06T14:29:22","slug":"anti-spoofing","status":"publish","type":"page","link":"https:\/\/www.internetsociety.org\/deploy360\/anti-spoofing\/","title":{"rendered":"Anti-Spoofing"},"content":{"rendered":"\n
<\/div>
\n
<\/div>\n
<\/div>\n\n\n\n

Internet Technologies<\/a> > Anti-Spoofing<\/p>\n\n\n\n

<\/div>\n\n\n\n

Anti-Spoofing<\/h1>\n\n\n\n
<\/div>\n<\/div>\n<\/div><\/section>\n\n\n\n
\n
<\/div>\n\n\n\n
\n
<\/div>\n\n\n\n

How do we help prevent the massive Distributed Denial-of-Service (DDoS) attacks we continue to see on the Internet? What can be done by network operators, enterprises, and others to help reduce DDoS attacks and other similar threats?<\/h2>\n\n\n\n
<\/div>\n\n\n\n

There are unfortunately no magic silver bullets, but one mechanism that can<\/em> be implemented by network operators is the prevention of \u201cspoofing\u201d of IP addresses, what we call \u201canti-spoofing technologies.\u201d<\/p>\n\n\n\n

To execute a DDoS attack, what commonly happens is that attackers use malware and \u201cbots\u201d running on unsuspecting computers to send large quantities of requests at a target server. All of the requests typically have bogus, \u201cspoofed\u201d source IP addresses and so when the server attempts to answer these requests it gets stalled waiting to open connections to the non-existent requesting servers. The spoofed source IP addresses (either IPv4 or IPv6) also make it extremely hard to track down where the sources of the attacks are coming from.<\/p>\n\n\n\n

What seems to be an easy solution is to simply not allow packets to leave<\/em> your network to go to the rest of the Internet with a spoofed IP source address. Particularly at the very edge of the Internet, an enterprise or home network, for instance, can know precisely what range of IP addresses are on its network and only allow those addresses as source addresses for outgoing packets. It gets a bit more challenging and complicated in larger networks, but this approach in general is often called \u201cBCP 38<\/a>\u201d after the IETF Best Current Practice (BCP) of that name. Some people also call this \u201cnetwork ingress filtering<\/em>\u201d or \u201csource address validation<\/em>\u201c.<\/p>\n\n\n\n

Why, then, have we as an Internet community not widely implemented BCP 38 and its companion BCP 84<\/a>?<\/p>\n\n\n\n

We cover here some of the technologies, the tools, and the reasons for implementing anti-spoofing. Our goal is to make the Internet safer, faster and more secure \u2013 and help do as much as possible to prevent DDoS attacks.<\/p>\n\n\n\n

Basics<\/h2>\n\n\n\n
<\/div>\n\n\n\n