RFC 2267
Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
RFC 2267: Network Ingress Filtering 🎀
Okay bestie, this one's a January 1998 RFC from the Network Working Group 🦋. The authors are P. Ferguson from Cisco Systems, Inc. and D. Senie from BlazeNet, Inc. ✨ It's labelled Informational, so it's here to share info, not to set an official Internet standard. The header doesn't have any "Obsoletes" or "Updates" lines, so it isn't replacing or changing anything else. Its whole title is Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing 💅
Status of this Memo 🌸
Quick reality check: this memo gives info to the Internet community. It does not set any kind of Internet standard. Anyone can distribute it, with no limits 🫶
Copyright Notice 💜
Copyright (C) The Internet Society (1998). All Rights Reserved. 🔒
Abstract ✨
Lately, Denial of Service (DoS) attacks that use forged source addresses have been a total headache for Internet Service Providers and the wider Internet community 😭 This doc walks through a simple, effective, and straightforward way to use ingress traffic filtering. The goal is to stop DoS attacks that use fake IP addresses from getting sent out from behind an Internet Service Provider's (ISP) aggregation point 🛑
Table of Contents 📑
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . 2
2. Background . . . . . . . . . . . . . . . . . . . . . . . . 2
3. Restricting forged traffic . . . . . . . . . . . . . . . . 5
4. Further capabilities for networking equipment. . . . . . . 6
5. Liabilities. . . . . . . . . . . . . . . . . . . . . . . . 6
6. Summary. . . . . . . . . . . . . . . . . . . . . . . . . . 7
7. Security Considerations. . . . . . . . . . . . . . . . . . 7
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . 8
9. References . . . . . . . . . . . . . . . . . . . . . . . . 8
10. Authors' Addresses . . . . . . . . . . . . . . . . . . . . 9
11. Full Copyright Statement . . . . . . . . . . . . . . . . . 101. Introduction 🧚
Okay so DoS attacks [1] have made a huge comeback and are targeting all kinds of stuff across the Internet 💀 That's a real challenge for ISP and network security folks, who need new and innovative ways to reduce these attacks. It's not easy 😩 Some simple tools already exist to limit how much damage these attacks can do and how far they spread, but they just haven't been widely deployed yet.
This attack method has been around for a while, and defending against it has been a long-running worry 🙈 Bill Cheswick is quoted in [2] saying he pulled a chapter from his book, "Firewalls and Internet Security" [3], at the last minute. Why? Because an administrator of a system under attack had no real way to defend it. He was also worried that talking about the method would encourage people to use it 😬
Here's the thing: the filtering method in this document does absolutely nothing against flooding attacks that come from valid prefixes (IP addresses) 🙅♀️ But it will stop an attacker inside the originating network from launching this kind of attack with forged source addresses that don't follow the ingress filtering rules. All providers of Internet connectivity are urged to implement the filtering described here, so attackers can't use forged source addresses that aren't inside a range of legitimately advertised prefixes. In other words, if an ISP is aggregating routing announcements for several downstream networks, strict traffic filtering should be used to block any traffic claiming to come from outside those aggregated announcements 🔥
There's a bonus too! This kind of filtering makes it way easier to trace an attack back to its real source, because the attacker would have to use a valid, legitimately reachable source address 🕵️♀️✨
2. Background 🍓
Here's a simplified diagram of the TCP SYN flooding problem:
9.0.0.0/8
host <----- router <--- Internet <----- router <-- attacker
TCP/SYN
<---------------------------------------------
Source: 192.168.0.4/32
SYN/ACK
no route
TCP/SYN
<---------------------------------------------
Source: 10.0.0.13/32
SYN/ACK
no route
TCP/SYN
<---------------------------------------------
Source: 172.16.0.2/32
SYN/ACK
no route
[etc.]Let's assume:
- The "host" is the targeted machine 🎯
- The attacker lives inside the "valid" prefix, 9.0.0.0/8 😈
- The attacker launches the attack with randomly changing source addresses. In this example, the source addresses come from within [4], which aren't generally present in the global Internet routing tables, so they're unreachable. But honestly, any unreachable prefix could be used for this attack method 🙃
There's another sneaky version, where the source address is forged to look like it came from a different legitimate network that is in the global routing table(s). Say an attacker uses a valid network address to make the attack look like it's coming from an organization that didn't start it and is totally innocent 😭 In that case, the administrator of the system under attack might want to filter all traffic from that apparent source. But doing that would cause a denial of service for legitimate, non-hostile end-systems. So the administrator ends up unknowingly helping the attacker 💀
It gets worse 😩 TCP SYN flood attacks cause SYN-ACK packets to be sent to one or many hosts that have nothing to do with the attack, making them secondary victims. That means the attacker can abuse two or more systems at once.
Similar attacks have been tried using UDP and ICMP flooding too. The UDP flooding attack uses forged packets to try to connect the chargen UDP service to the echo UDP service at another site. Systems administrators should NEVER allow UDP packets destined for system diagnostic ports from outside their administrative domain to reach their systems 🚫
The ICMP flooding attack uses a sneaky feature in how IP subnet broadcasts get replicated. This attack depends on a router serving a large multi-access broadcast network to wrap an IP broadcast address (like one destined for 10.255.255.255) in a Layer 2 broadcast frame (for ethernet, FF:FF:FF:FF:FF:FF). In normal operation, Ethernet NIC hardware (specifically the MAC layer) only listens to a select number of addresses. The one MAC address that every device shares in normal operation is the media broadcast, FF:FF:FF:FF:FF:FF. So a device takes the packet and sends an interrupt for processing. That means a flood of these broadcast frames can use up all the available resources on an end-system [9] 🥴 It's probably smart for system administrators to make sure their border routers don't forward directed broadcast packets by default.
When a TCP SYN attack uses an unreachable source address, the target host tries to reserve resources while it waits for a response. The attacker keeps changing the bogus source address on each new packet, which uses up even more host resources 😵
If the attacker uses someone else's valid host address as the source instead, the system under attack sends a big pile of SYN/ACK packets to what it thinks is the originator of the connection setup. So the attacker damages two systems: the destination target, and the innocent system that's actually using the spoofed address in the global routing system 💔
Both attack methods lead to extremely degraded performance or, even worse, a system crash 🫠
To fight this threat, most operating system vendors changed their software so targeted servers can survive attacks with very high connection attempt rates. That's a welcome and necessary part of the solution 👑 Ingress filtering will take time to roll out everywhere and be fully effective, but operating system extensions can be deployed quickly. Put them together and you've got something that should work well against source address spoofing 🌈 See [1] for vendor and platform software upgrade info.
3. Restricting forged traffic 💖
Attacks like this are a mess, and they involve problems in host software implementations, routing methodologies, and the TCP/IP protocols themselves 🌀 But if you restrict transit traffic coming from a downstream network to its known, intentionally advertised prefix(es), then source address spoofing can be virtually eliminated in this attack scenario 🎉
11.0.0.0/8
/
router 1
/
/
/ 9.0.0.0/8
ISP <----- ISP <---- ISP <--- ISP <-- router <-- attacker
A B C D 2
/
/
/
router 3
/
12.0.0.0/8Look at the example above. The attacker lives in 9.0.0.0/8, which gets its Internet connectivity from ISP D. An input traffic filter on the ingress (input) link of "router 2", the one that connects to the attacker's network, only lets through traffic from source addresses inside the 9.0.0.0/8 prefix. Any attacker trying to use "invalid" source addresses outside that range gets blocked 🚧
So the ingress filter on "router 2" above would check:
IF packet's source address from within 9.0.0.0/8
THEN forward as appropriate
IF packet's source address is anything else
THEN deny packetLast but not least, network administrators should log information about the packets that get dropped 📝 That gives them a basis for keeping an eye on any suspicious activity 👀✨
4. Further possible capabilities for networking equipment ✨
okay bestie, let's talk about extra features that future platforms could totally add 🧚 The one that's worth noting is:
- Automatic filtering on remote access servers 💅 In most cases, a user dialing into an access server is just one person on a single PC. The only valid source IP address for packets coming from that PC is the one the ISP assigned to it, whether that's static or dynamic. The remote access server could check every packet on ingress to make sure the user isn't spoofing the source address on the packets they send 👀 Obviously, there also need to be provisions for when the customer legitimately attaches a net or subnet through a remote router, but this could totally be an optional parameter 🎀 We've heard reports that some vendors and some ISPs are already starting to do this 🔥
We considered suggesting that routers also validate the source IP address of the sender, like [8] suggests, but ngl that approach won't work well in the real networks out there today 🙈 The method suggested is to look up the source address and check that the return path to it would go out the same interface the packet arrived on. With all the asymmetric routes on the Internet, that would clearly be a problem 😭
5. Liabilities 🥺
Filtering like this has the potential to break some types of "special" services 💔 Still, it's in the best interest of an ISP offering these special services to think about alternate ways to implement them so they aren't affected by ingress traffic filtering 🫶
Mobile IP, as defined in [6], is specifically affected by ingress traffic filtering 😬 As specified, traffic to the mobile node is tunneled, but traffic from the mobile node is not. This means packets from the mobile node(s) can have source addresses that don't match the network where the station is attached. The Mobile IP Working Group is working on this by specifying "reverse tunnels" in [7] ✨ This work in progress gives a method for the data sent from the mobile node to be tunneled to the home agent before it goes out to the Internet. Reverse tunneling has some extra perks too, including better handling of multicast traffic 🌈 Anyone implementing mobile IP systems is encouraged to use this method of reverse tunneling 💜
As mentioned earlier, ingress traffic filtering drastically reduces the success of source address spoofing, but it doesn't stop an attacker from using a forged source address belonging to another host within the permitted prefix filter range 🙅♀️ What it does do is make sure that when an attack like this happens, a network administrator can be sure it's coming from within the known prefixes being advertised 🕵️♀️ That makes tracking down the culprit way easier, and at worst, the administrator can block a whole range of source addresses until the problem is fixed 🛑
If ingress filtering is used in an environment where DHCP or BOOTP is used, the network administrator would be well advised to make sure that packets with a source address of 0.0.0.0 and a destination of 255.255.255.255 are allowed to reach the relay agent in routers when appropriate 🍓 The scope of directed broadcast replication should be controlled, though, and not arbitrarily forwarded ⚠️
Heads up: directed broadcast replication should be controlled, not arbitrarily forwarded. Don't just let it run wild! 🙅♀️
6. Summary 🌸
Ingress traffic filtering at the edges of Internet-connected networks will reduce how effective source address spoofing denial of service attacks are 💖 Network service providers and administrators have already started doing this kind of filtering on edge routers, and it's recommended that all service providers do it as soon as possible 🏃♀️💨 Besides helping the whole Internet community beat this attack method, it can also help service providers locate the source of an attack, if they can clearly show that their network already has ingress filtering on customer links 🎯
Corporate network administrators should implement filtering so their corporate networks aren't the source of these problems 🏢 Honestly, filtering can also be used inside an organization to make sure users don't cause trouble by improperly attaching systems to the wrong networks 🧑💻 It could even stop a disgruntled employee from launching anonymous attacks 👀
It's the responsibility of all network administrators to make sure they don't become the unwitting source of an attack like this 🫡
7. Security Considerations 🔐
The main goal of this document is to inherently raise security practices and awareness across the whole Internet community 📣 As more Internet Providers and corporate network administrators implement ingress filtering, the opportunity for an attacker to use forged source addresses as an attack method will significantly drop 📉 Tracking an attack's source gets way simpler when the source is more likely to be "valid" 🔍 By reducing the number and frequency of attacks across the whole Internet, there will be more resources left for tracking the attacks that still happen 💪 This is a seriously important section, bestie, so take it to heart 😤
8. Acknowledgments 🙌
The North American Network Operators Group (NANOG) [5] deserves huge credit as a whole for openly discussing these issues and actively looking for solutions 👑 Also, a big thank you to Justin Newton [Priori Networks] and Steve Bielagus [OpenROUTE Networks, Inc.] for their comments and contributions 💕
9. References 📚
- [1] CERT Advisory CA-96.21; TCP SYN Flooding and IP Spoofing Attacks; September 24, 1996.
- [2] B. Ziegler, "Hacker Tangles Panix Web Site", Wall Street Journal, 12 September 1996.
- [3] "Firewalls and Internet Security: Repelling the Wily Hacker"; William R. Cheswick and Steven M. Bellovin, Addison-Wesley Publishing Company, 1994; ISBN 0-201-63357-4.
- [4] Rekhter, Y., Moskowitz, R., Karrenberg, D., de Groot, G., and E. Lear, "Address Allocation for Private Internets", RFC 1918, February 1996.
- [5] The North American Network Operators Group;
http://www.nanog.org. - [6] Perkins, C., "IP Mobility Support", RFC 2002, October 1996.
- [7] Montenegro, G., "Reverse Tunneling Mobile IP", Work in Progress.
- [8] Baker, F., "Requirements for IP Version 4 Routers", RFC 1812, June 1995.
- [9] Thanks to: Craig Huegen; See:
http://www.quadrunner.com/~chuegen/smurf.txt.
10. Authors' Addresses 🖊️
Paul Ferguson
cisco Systems, Inc.
400 Herndon Parkway
Herndon, VA USA 20170
EMail: ferguson@cisco.com
Daniel Senie
BlazeNet, Inc.
4 Mechanic Street
Natick, MA USA 01760
EMail: dts@senie.com11. Full Copyright Statement ⚖️
Legal bits are serious business, so here's the copyright statement exactly as written 🫶
Copyright (C) The Internet Society (1998). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.📦 where this page comes from
- ietf: rfc2267 1998-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms