[lkml]   [2000]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subjectrp_filter against spoofing

This discussion started on Bugtraq on the 'DDOS Attack Mitigation'
there seem to be quite a bit of confusion as of the purpose rp_filter;
talked with some admins and many were relying on rp_filter to filter
_spoofed packets_. Basically only firewall rules seem to do the job

I was initially suggesting that Linux provides a way to drop outgoing
with source address that doesn't match any local interface, say using a
table that could be occasionally sorted according to an interface's avg.
i was told that rp_filter drops spoofed packets; i was able to route a
packet well with an unexisting source address through my router with
on an firewall ingress filtering off; the packet arrived to destination.

Please forgive me if this was alerady discussed; I think at least the
should be a bit more clear and explain that rp_filter does not protect
IP spoofing at all, and does not do ingress filtering. It's obvious and
documented, but some admins still rely on rp_filter to do ingress
filtering, and
that might be part of the problem.

From 2.2.14's

> If you turn on IP forwarding, you will also get the rp_filter, which
> automatically rejects incoming packets if the routing table entry
> for their source address doesn't match the network interface they're
> arriving on. This has security advantages because it prevents the
> so-called IP spoofing, however it can pose problems if you use
> asymmetric routing (packets from you to a host take a different path
> than packets from that host to you) or if you operate a non-routing
> host which has several IP addresses on different interfaces. To turn
> rp_filter off use:
> echo 0 > /proc/sys/net/ipv4/conf/<device>/rp_filter
> or
> echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

And from networking/ip-sysctl.txt:

> rp_filter - INTEGER
> 2 - do source validation by reversed path, as specified in RFC1812
> Recommended option for single homed hosts and stub network
> routers. Could cause troubles for complicated (not loop free)
> networks running a slow unreliable protocol (sort of RIP),
> or using static routes.
> 1 - (DEFAULT) Weaker form of RP filtering: drop all the packets
> that look as sourced at a directly connected interface, but
> were input from another interface.
> 0 - No source validation.

I must be missing something, but isn't rp_filter just making some admins
thinking spoofed traffic won't go through? I think an optional feature
that would
do source address verification against lookup table, given enough
could be a big help in reducing DOS attacks from Linux boxes.

I know, it's the border router's job - but working w/ an isp that does
we can't trust the LAN and most harmful attacks of course come from the
inside, also
think of boxes with a direct Internet connection.

Need more info on DDOS attacks, see Bennett Todd's excellent DDoS
whitepaper --


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:56    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean