Network Hygiene, Incentives, and Regulation: Deployment of Source Address Validation in the Internet
Authors
Luckie, Matthew
Beverly, Robert
Koga, Ryan
Keys, Ken
Kroll, Joshua A.
claffy, k
Subjects
IP spoofing
remediation
remediation
Advisors
Date of Issue
2019
Date
2019
Publisher
Association for Computing Machinery (ACM)
Language
Abstract
The Spoofer project has collected data on the deployment and characteristics of IP source address validation on the Internet since 2005. Data from the project comes from participants who install an active probing client that runs in the background. The client automatically runs tests both periodically and when it detects a new network attachment point. We analyze the rich dataset of Spoofer tests in multiple dimensions: across time, networks, autonomous systems, countries, and by Internet protocol version. In our data for the year ending August 2019, at least a quarter of tested ASes did not filter packets with spoofed source addresses leaving their networks. We show that routers performing Network Address Translation do not always filter spoofed packets, as 6.4% of IPv4/24 tested in the year ending August 2019 did not filter. Worse, at least two thirds of tested ASes did not filter packets entering their networks with source addresses claiming to be from within their network that arrived from outside their network. We explore several approaches to encouraging remediation and the challenges of evaluating their impact. While we have been able to remediate 352 IPv4/24, we have found an order of magnitude more IPv4/24 that remains unremediated, despite myriad remediation strategies, with 21% unremediated for more than six months. Our analysis provides the most complete and confident picture of the Internet’s susceptibility to date of this long-standing vulnerability. Although there is no simple solution to address the remaining long-tail of unremediated networks, we conclude with a discussion of possible non-technical interventions, and demonstrate how the platform can support evaluation of the impact of such interventions over time.
Type
Article
Description
The article of record as published may be found at https://doi.org/10.1145/3319535.3354232
Series/Report No
Department
Organization
Naval Postgraduate School
Identifiers
NPS Report Number
Sponsors
Funding
Format
16 p.
Citation
Luckie, Matthew, et al. "Network Hygiene, Incentives, and Regulation: Deployment of Source Address Validation in the Internet." Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 2019.
Distribution Statement
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.