O Verview - HP ProCurve 9304M Security Manual

Overview
HP devices support unicast reverse path forwarding (unicast RPF). Unicast RPF can be used as a defense
against Denial of Service (DoS) attacks in which an attacker attempts to flood a network with packets that have
spoofed or falsified source IP addresses.
When unicast RPF is enabled on an interface, the HP device examines the source address of each incoming
packet and verifies that this interface is the correct one to receive packets with that source address. If this is not
the correct interface to receive the packet, then the packet is dropped.
For example, in one type of DoS attack an attacker may attempt to send a large amount of traffic into a network
through an external interface, using spoofed addresses of the internal network as the source of the traffic. When
the unicast RPF feature is enabled, the HP device recognizes that traffic coming in on an external interface should
not have source addresses belonging to the internal network, and the HP device consequently drops the traffic
with the spoofed source addresses.
When you configure unicast RPF on an interface, you specify which interfaces are external. External interfaces
are those that can receive traffic from external networks, but not from the internal network. When an interface is
specified as an external interface for unicast RPF, the HP device creates CAM entries that correspond to the
internally learned routes in the device's routing table. The unicast RPF CAM entries deny packets with source IP
addresses that correspond to the internally learned routes. All other traffic is permitted.
To accommodate routing table changes, the internally learned routes are synchronized with the unicast RPF CAM
entries every 1 minute.
Figure 9.1 shows an illustration of a network that uses unicast RPF.
June 2005
Configuring Unicast RPF
Chapter 9
9 - 1