----- Original Message ----- > From: "Jared Mauch" <ja...@puck.nether.net> > To: "Frank Bulk" <frnk...@iname.com> > Cc: nanog@nanog.org > Sent: Tuesday, November 22, 2016 10:44:09 AM > Subject: Re: BCP 38 coverage if top x providers ...
>> On Nov 19, 2016, at 9:13 PM, Frank Bulk <frnk...@iname.com> wrote: >> >> My google fu is failing me, but I believe there was a NANOG posting a year >> or two ago that mentioned that if the top x providers would implement BCP 38 >> then y% of the traffic (or Internet) would be de-spoofed. The point was >> that we don't even need everyone to implement BCP 38, but if the largest >> (transit?) providers did it, then UDP reflection attacks could be minimized. >> >> If someone can recall the key words in that posting and dig it up, that >> would be much appreciated. > > If you assume 80% of traffic comes out of your local CDN node, that remaining > 20% > may not be too difficult for you to do something with. The problem appears > because > various engineering thresholds that existed in the 90s have been violated. > > 40(64) byte packet testing is no longer the norm by vendors. Those of us who > carry > a full table and are expected to provide all the features are the minority in > purchasing equipment by volume and revenue so the push is harder. A double > lookup > of the packet is twice as expensive and perhaps impractical in some (or many) > cases. It was me, Frank, as I said in an offlist email your mail server a) didn't like and b) took 4 days to complain about. :-) I believe I said "top 10" or "top 20" eyeball carriers, and I was shooting from the hip, based on my apprehension of the sizes there of. 80/20 rule, as Jared implies. Cheers, -- jra -- Jay R. Ashworth Baylink j...@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274