Subject: Re: [savi] [SAVI]possible future works

From: Bingyang LIU <[email-masked]>
Date: Sat, 24 Sep 2011 12:25:33 -0400

uRPF loose mode has significant false negative. Surprisingly, it also has
false positive.

False negative: uRPF only checks the existence of the source prefix in the
forwarding table, rather than checking the reverse direction. A random
selected source address has the probability of 0.58 (according to the
current advertised IPv4 address space in BGP) to circumvent uRPF loose mode,
which results in very high false negative. Besides, a slightly smarter
attacker can use routable source addresses rather than using random ones, so
that she can circumvent all loose mode uRPF checks. Finally, uRPF loose mode
can do nothing with Distributed Redirected DoS (DrDoS). In DrDoS the source
addresses of the spoofing packets'  are the victims' IP addresses which are
obviously routable and considered valid by uRPF loose mode. As known, a
DrDoS attack amplified by DNS reached the 100Gbps, which is the highest
attack volume ever observed, according to ARBOR's security report 2010.

False positive: uRPF loose mode is considered to be very loose to avoid
false positive. However it may cause false positive when applied to non-DFZ
(default free zone). Consider the scenario in this picture [
http://netarchlab.tsinghua.edu.cn/~liuby/fp.jpg]. D is an border router of
the non-DFZ, and the FIB is listed. According to uRPF loose mode, the valid
packet (src=2.0.0.0/8, dst=1.1.0.0/16) sent from S to D through P2 will be
denied by D, because 2.0.0.0/8 matches the default route (in either type of
loose mode uRPF defined in RFC3704, the packet will be denied). Briefly
speaking, uRPF loose mode may cause false positive in non-DFZ.

We obviously need better technique to source spoofing than uRPF loose mode.

Bingyang Liu

------------------------------

I agree that those are potential topics of SAVI WG.

Regarding to the SAVI for IPv4/IPv6 co-existence and transition, I also think
we need to study source address validation for those "traditional" IPv6
transition methods, such as ISATAP, etc. In CERNET2 operation, we had found
that some users access IPv6 by ISATAP, but for some reasons, they didn't use
the IPv6 source address of that tunnel, but use the IPv6 source address of
another LAN interface of the same PC.

Another potentail area is to study SAVI beyond the local link, for example, to
ehance uRPF loose mode by reduceing the false negative.

thanks,
Jun Bi

-----ååéä----- From: xuke

Sent: Saturday, September 24, 2011 4:17 PM
To: SAVI Mailing List
Subject: [savi] [SAVI]possible future works

Dear SAVI WG members

There is no doubt, SAVI has made significant contribution for IP source address
validation and anti-spoofing in the scenario of pure IPv6 Ethernet access
subnet. However, there are many efforts need SAVI workgroup to make and
there are many works to be done for SAVI prompting, there are some possible
future works I suggest: (1) Considering there would be a long period to
transit IPv4 to IPv6,workgroup should study SAVI how to work in the
scenarios of 4 over 6,

light-weighted 4 over 6 and NAT4-4-4 etc.

(2) Applying SAVI technology into non-Ethernet access subnet circumstance. In
the matter of fact, many netizens still use PPoE, ADSL and ISDN technology
to access Internet. It means a lot to telecommunication carriers for
applying SAVI into those scenarios. (3) Even though SAVI has a preliminary
application in WiFi scenario, its application in mobile communication(3G,LTE
etc.) scenario still need to

be exploited.

xuke

-- 
Bingyang Liu
Network Architecture Lab, Network Center,Tsinghua Univ.
Beijing, China
Home Page: http://netarchlab.tsinghua.edu.cn/~liuby

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 25 Sep 2011 09:17:31 +0200 (CEST)

> We obviously need better technique to source spoofing than uRPF loose 

In my opinion, for IPv4 uRPF loose is only used for ddos protection in 
conjunction with null-routing the prefix of the source you want to block.

Using it for antispoofing stopped working a long time ago, as you pointed 
out.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: "Jun Bi" <[email-masked]>
Date: Sun, 25 Sep 2011 15:45:08 +0800

>Using it for antispoofing stopped working a long time ago, as you pointed 

Yes, so maybe SAVI WG could extend the charter to cover that filed.

thanks,
Jun Bi

-----原始邮件----- 
From: Mikael Abrahamsson
Sent: Sunday, September 25, 2011 3:17 PM
To: Bingyang LIU
Cc: [email-masked]
Subject: Re: [savi] [SAVI]possible future works

-- 
Mikael Abrahamsson    email: [email-masked]
_______________________________________________
savi mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/savi