Stephen Stuart wrote:
I made what I consider to be non-trivial progress toward stamping that out before my time at the helm of 6461 ended. I happen to know that the people still there are trying to continue making progress on that front, what is going on around them.
Confucious say: Man who sit on rose bush soon get point.
Would you care to take a shot at answering my question, or is contributing productively too much to ask?
My employer believes against filtering on source or destination. Communicate in total privacy. Get your free encrypted email at https://www.hushmail.com/?l=2 Looking for a good deal on a domain name? http://www.hush.com/partners/offers.cgi?id=domainpeople
Would you care to take a shot at answering my question, or is contributing productively too much to ask?
My employer believes against filtering on source or destination.
Are you at liberty to share that reason for that? If you know that the source address is bogus (for whatever reason, RFC1918 source address is my favorite example), why not act on the fact that it is bogus? Is it economic - are you collecting revenue for that traffic? Do you believe that the router's performance or stability are adversely affected by restricting the traffic that you pass in any manner? Stephen
On Wed, 07 Aug 2002 18:07:37 -0700, Stephen Stuart wrote:
Would you care to take a shot at answering my question, or is contributing productively too much to ask?
My employer believes against filtering on source or destination.
Are you at liberty to share that reason for that? If you know that the source address is bogus (for whatever reason, RFC1918 source address is my favorite example), why not act on the fact that it is bogus? Is it economic - are you collecting revenue for that traffic? Do you believe that the router's performance or stability are adversely affected by restricting the traffic that you pass in any manner?
Stephen
One thing that sometimes comes up is that people do number links using RFC1918 address space which occasionally results in an ICMP 'fragmentation needed but DF bit set' packet with an RFC1918 source address. Filtering out this packet could result in TCP breaking. Of course people shouldn't do that, but solutions of the form "make everybody else fix it" aren't as useful as solutions of the form "you fix it this particular way". IMO, this is the only justification for not filtering RFC1918 and it's marginal at best. Personally, if a packet doesn't identify where it's actually from, I don't want it on my network. DS
participants (4)
-
David Schwartz -
jnull -
sal_sabellaï¼ hushmail.com -
Stephen Stuart