On Thu, Mar 13, 1997, 3:39:29 AM PST George Herbert wrote:

I believe you can just deny by default and allow traffic from the registered address blocks under each interface, on incoming interfaces at your central router (and sub-routers). Nice short list.

-george william herbert gherbert@crl.com

This is obviously better then nothing, and probably the most practical solution, but most networks have holes in their allocated blocks. Wouldn't some sort of authentication scheme (RADIUS/TACACS or maybe Kerbros) be a better solution? More complicated for sure. The idea would be to check the connection request to the outgoing router against some sort of database, then expiring the token after it's use. The real trick to this is checking only the initial request. Something more in the realm of switching authentication... Anyone have any ideas how something as large as a class B with say 30% address utilization on scattered addresses (non-contigeous) could be rapidly verified without checking every packet? Thanks for your indulgance, Chris Cook Network Engineer __________________________________________________________________________ Net Asset Network Operations Center 1315 Van Ness Ave., Suite 103 Fresno CA 93721 209/225-0222