Internet2 Network Security SIG

["Garrett, Seth B" <>]

We're averaging about 36,826 spoofed packets a day since Global Summit at our main Bloomington campus.  These would packets being sent to IU with our own IP as the source.  Its fairly consistent.  

23,035,796 packets have been source RPF drops as a security response (RTBH Null routing + RPF).

Thanks,

Seth Garrett
Principal Network Systems Engineer
Indiana University

---

From: <> on behalf of Paul Howell <>
Sent: Friday, May 11, 2018 6:55 AM
To:
Subject: Re: [Security-WG] Spoof/RPF Numbers

 

Hi Seth,

 

Thanks for the numbers.   Does the rate of drops/blocks happen more or less  consistently 24x7, or do you notice patterns?

 

Regards,

Paul

 

 

From: <> on behalf of "Garrett, Seth B" <>
Reply-To: "" <>
Date: Thursday, May 10, 2018 at 3:06 PM
To: "" <>
Subject: [Security-WG] Spoof/RPF Numbers

 

Some numbers I volunteered to get during the Internet2 Global Summit Security Working Group lunch.

 

1.       How often are Indiana University IPs spoofed to IU from external sources:

o    ​​Over a 10 minute period we drop approximately 700 packets that have our own IP space spoofed as a source.

2.       ​Internet facing RPF drops as a security response:

o    ​​This is our RTBH system combined with RPF to source block external offenders that are null routed

o    Over a 10 minute period it blocked 1,550,000 packets 

 

 

Seth Garrett
Principal Network Systems Engineer
Indiana University