|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Automatic filtering - CISCO, you should think about this...
Karl Denninger writes... > How about an interface keyword such as "auto-inbound-filter", which does > this: > > At STARTUP and when the LOCAL route table changes (ie: "ip route > xxx..." statements) the system looks at the interfaces, and the > local static routes, and builds an accept list for that interface. > The list is stored in a "reserved" set of system access lists. > > Add a parmaeter which can be turned on (ie: log) which would add > "log" to the end of the filter lists, so that anyone TRYING to smurf > will get logged > > This would totally automate the process of inbound filtering to prevent or > severely limit smurf attacks. > > Since filters which are based only on the source address are relatively > cheap for the router to process, this would likely not seriously burden > anyone in their direct connections. > > I'd love to see something like this, and it would reduce the complaint that > its "too hard to manage" such things. How about having "no-auto-inbound-filter" instead, making the default in all new versions of IOS be to run this essential level of protection, providing a means to turn it off only for those who know they need to turn it off. -- Phil Howard | [email protected] [email protected] [email protected] phil | [email protected] [email protected] [email protected] at | [email protected] [email protected] [email protected] milepost | [email protected] [email protected] [email protected] dot | [email protected] [email protected] [email protected] com | [email protected] [email protected] [email protected]
|