Internet2 Network Security SIG

[John Kristoff <>]

On Mon, 6 Nov 2017 14:32:44 +0000
gcbrowni 
<>
 wrote:

> Let me know if you think anything is missing; I’m interesting in
> making sure we capture the thinking of the working groups.

Sorry I was absent from this discussion, but let me add something that
some in the Internet research community might raise.

> Recently a trial filter was implemented on the Internet2 Ashburn
> router. The edge filter implements an anti-spoofing filter for
> internal Internet2 addresses. The goal is to reject inbound traffic
> using Internet2 source-IP’s that are sourced outside of Internet2.

This is probably a good compromise.

Traceroute in various forms have been widely used for measuring and
discovering Internet infrastructure.  One technique that was used at
least as far back as Bill Cheswick's early Internet map production days
was to spoof the source address of traceroute messages from multiple
sources so responses all went back to a central collector.  This helps
not only for collection, but also helps identify paths, links, and
interfaces from different vantage points.

This technique has been adapted over the years and just last week was
brought up again at the Internet Measurement Conference as a valid and
useful way researchers use to measure and understand the Internet.

It would be nice, if possible, to allow this sort of activity.  It
should be feasible without too much trouble to allow pinholes from the
edge networks where this can be carefully scoped to legitimate research
projects.

Researchers may want it opened even further than the experimental
filters above, but what you've done seems like an appropriate compromise
to me.

Happy to make introductions to the researchers if desirable.  They may
have more to say about their needs and wants.

John