Packet Spoofing - Avaya 8800 Planning And Engineering, Network Design

Network security

Packet spoofing

You can stop spoofed IP packets by configuring the switch to only forward IP packets that contain
the correct source IP address of your network. By denying all invalid source IP addresses, you
minimize the chance that your network is the source of a spoofed DoS attack.
A spoofed packet is one that comes from the Internet into your network with a source address equal
to one of the subnet addresses used on your network. Its source address belongs to one of the
address blocks or subnets used on your network. To provide spoofing protection, you can use a
filter that examines the source address of all outside packets. If that address belongs to an internal
network or a firewall, the packet is dropped.
To prevent DoS attack packets that come from your network with valid source addresses, you need
to know the IP network blocks that are in use. You can create a generic filter that:
• permits valid source addresses
• denies all other source addresses
To do so, configure an ingress filter that drops all traffic based on the source address that belongs to
your network.
If you do not know the address space completely, it is important that you at least deny Private (see
RFC1918) and Reserved Source IP addresses. The following table lists the source addresses to
filter.
Table 30: Source addresses that need to be filtered
Address
0.0.0.0/8
10.0.0.0/8
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.2.0/24
192.168.0.0/16
224.0.0.0/4
240.0.0.0/5
248.0.0.0/5
255.255.255.255/32
You can also enable the spoof-detect feature on a port.
For more information about the spoof-detect feature, see Avaya Ethernet Routing Switch 8800/8600
Configuration — VLANs and Spanning Tree, NN46205-517.
June 2016
Description
Historical Broadcast. High-Secure mode blocks addresses 0.0.0.0/8 and
255.255.255.255/16. If you enable this mode, you do not have to filter
these addresses.
RFC1918 Private Network
Loopback
Link Local Networks
RFC1918 Private Network
TEST-NET
RFC1918 Private Network
Class D Multicast
Class E Reserved
Unallocated
Broadcast1
Planning and Engineering — Network Design
Comments on this document? infodev@avaya.com
270