There are some basic protections an ISP can take, but really what Gibson is crying about is an end-node security problem. What can ISPs do? Doesn't their ability to add value to the security equation revolve around each ISP performing its role in the process of routing and distributing packets, no more and no less? Aside from removing spoofed packets, performing ingress and egress filtering, and responding to direct customer and supplier needs, I don't see anything else an ISP itself can do. One caveat to the above: I don't buy all this bullshit about "peering" vs. "customer/supplier" relationships. If you send a packet to a network, you are that network's supplier and should be willing to act in a supplier's capacity. If you receive a packet from a network, you are that network's customer and should be willing to act as a customer. If you are doing both, then you have to put on both hats as needed and step up to take responsibility for the business arrangement as it is. Hiding behind peering agreements to ignore problems or blame the other party solves nothing. Lack of security clue on the part of an end-node is an end-node's problem. If all the people who run Windows boxes suddenly went to RedHat 7, we'd have a mass of lpd, wu-ftpd, rpc.statd and similar problems. The solution lies with education of the ignorant masses on the basics of security. While this is not an ISP's responsibility, those immediately upstream of end-nodes may want to offer it as a value-added service. It would appear there is certainly a market. My $0.02. -- -------------------------------------------------------------------------- Stephen Kowalchuk skowalchuk@diamonex.com Diamonex, Incorporated Letting go does not mean you stop making decisions. You simply stop fighting where the decisions lead you. --------------------------------------------------------------------------

MS reply, for all this nonsense http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ raw_sockets.asp Benny Fischer Chief Technical Officer Infinet Internet Services benny@infinet-is.com 480-<snip>

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Ron Buchalski Sent: Monday, July 02, 2001 2:59 PM To: rapier@psc.edu Cc: nanog@merit.edu Subject: Re: GRC rides again...

Chris Rapier writes:

...

From: Chris Rapier <rapier@psc.edu> CC: nanog@merit.edu Subject: Re: GRC rides again... Date: Mon, 02 Jul 2001 10:45:39 -0400

My feeling is that he's missing some clues regarding the necessary realities of the situation. Its not so much a matter of laziness,

<snip>

...

I'm also sure that XP might increase the number of spoofed packets running through the network. If that spurs more ISPs to use source address filtering them thats a good thing. Even if they don't it is possible to track down where a spoofed IP is coming from - its more of a social engineering issue than a technical one.

The GRC page talks about his dos attack, and he also rants about the "dangers" of the IP stack in XP, but his dos attack didn't come from sources sending spoofed packets, so source address filtering wouldn't have helped in this case. GRC complaining about the spoofed packet problem should be a separate rant on his website (who knows...it probably is!).

-rb

_________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com