I know it’s possible to modify the IP headers and change the source IP address, but it should be simple for network devices to detect and discard those messages. If they don’t, why not? Does it add too much overhead?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I know it’s possible to modify the IP headers and change the source IP address, but it should be simple for network devices to detect and discard those messages. If they don’t, why not? Does it add too much overhead?
The industry name for the feature you are asking about is called "Unicast Reverse Path Forwarding" (or as Cisco calls it, "uRPF"); it is defined in RFC 3704 and is considered a Best Current Practice (see BCP38).
Speaking at a very high level, most of the hardware used by ISPs has this feature built into an ASIC; normally there is not a huge penalty for turning it on. Sometimes there are feature conflicts, but again this is not a huge deal in most cases.
The biggest reason it isn’t universal is because the internet is still somewhat like the American "wild west" in the 1800s; consider them analagous to a town’s sheriff. The policies and competency of the engineering/operational personnel varies, and many ISPs are too busy with making things "work" that they don’t have cycles to make things "work well".
That dynamic is particularly true in smaller countries; I worked for a large network equipment manufacturer in a previous life and occasionally traveled throughout southeast asia conducting ISP seminars. Smaller countries are often half a decade (or more) behind the practices and competency of ISPs here in the US (that’s not to say that US ISPs are terribly great on the whole either, but they are generally much better off than, say, some of the ISPs operating in the smaller islands in the Pacific).
This results in the non-trivial amount of spamming / hacker traffic on the internet today… it’s there because they have no lack of places to hide. Source IP address spoofing is one of their first lines of defense.