The spoofer project: inferring the extent of source address filtering on the internet
Robert Beverly, Steven Bauer · 2005
Forging, or ”spoofing, ” the source addresses of IP pack-ets provides malicious parties with anonymity and novel attack vectors. Spoofing-based attacks complicate net-work operator’s defense techniques; tracing spoofing re-mains a difficult and largely manual process. More so-phisticated next generation distributed denial of service (DDoS) attacks may test filtering policies and adaptively attempt to forge source addresses. To understand the current state of network filtering, this paper presents an Internet-wide active measurement spoofing project. Clients in our study attempt to send carefully crafted UDP packets designed to infer filtering policies. When filtering of valid packets is in place we determine the fil-tering granularity by performing adjacent netblock scan-ning. Our results are the first to quantify the extent and nature of filtering and the ability to spoof on the Internet. We find that approximately one-quarter of the observed addresses, netblocks and autonomous systems (AS) per-mit full or partial spoofing. Projecting this number to the entire Internet, an approximation we show is reasonable, yields over 360 million addresses and 4,600 ASes from which spoofing is possible. Our findings suggest that a large portion of the Internet is vulnerable to spoofing and concerted attacks employing spoofing remain a serious concern. 1