Abstract:To protect themselves from attacks, networks need to enforce ingress filtering, i.e., block inbound packets sent from spoofed IP addresses. Although this is a widely known best practice, it is still not clear how many networks do not block spoofed packets. Inferring the extent of spoofability at Internet scale is challenging and despite multiple efforts the existing studies currently cover only a limited set of the Internet networks: they can either measure networks that operate servers with faulty network-stack implementations, or require installation of the measurement software on volunteer networks, or assume specific properties, like traceroute loops. Improving coverage of the spoofing measurements is critical. In this work we present the Spoofing Mapper (SMap): the first scanner for performing Internet-wide studies of ingress filtering. SMap evaluates spoofability of networks utilising standard protocols that are present in almost any Internet network. We applied SMap for Internet-wide measurements of ingress filtering: we found that 69.8% of all the Autonomous Systems (ASes) in the Internet do not filter spoofed packets and found 46880 new spoofable ASes which were not identified in prior studies. Our measurements with SMap provide the first comprehensive view of ingress filtering deployment in the Internet as well as remediation in filtering spoofed packets over a period of two years until May 2021. We set up a web service at <a class="link-external link-https" href="https://smap.cad.sit.fraunhofer.de" rel="external noopener nofollow">this https URL</a> to perform continual Internet-wide data collection with SMap and display statistics from spoofing evaluation. We make our datasets as well as the SMap (implementation and the source code) publicly available to enable researchers to reproduce and validate our results, as well as to continually keep track of changes in filtering spoofed packets in the Internet.

Performing software defined route-based IP spoofing filtering with SEFA

VASE: Filtering IP spoofing traffic with agility

Toward Incentivizing Anti-Spoofing Deployment

A Distributed IP Spoof Detection System in Intranet

MASK:An Efficient Mechanism to Extend Inter-Domain IP Spoofing Preventions

Faas: Filtering Ip Spoofing Traffic As A Service

Revisiting Inter-As IP Spoofing Let the Protection Drive Source Address Validation.

Enable a Trustworthy Network by Source Address Spoofing Prevention Routers: A Formal Description

Cutting Long-Tail Latency of Routing Response in Software Defined Networks.

Address Protection-as-a-Service An inter-AS Framework for IP Spoofing Resilience

Umbrella: A Routing Choice Feedback Based Distributed Inter-Domain Anti-Spoofing Solution

NETHCF: Enabling Line-rate and Adaptive Spoofed IP Traffic Filtering

LAS: An effective anti-spoofing method using existing information

A Novel Mechanism for Detection of Address Resolution Protocol Spoofing Attacks in Large-Scale Software-Defined Networks

Segment Level Authentication: Combating internet source spoofing

On Situational Aware En-Route Filtering against Injected False Data in Cyber Physical Systems

An inter-AS path vector filter: towards elimination of false negatives

Source Address Filtering For Large Scale Network: A Cooperative Software Mechanism Design

SAFE-ME: Scalable and Flexible Middlebox Policy Enforcement with Software Defined Networking

On the Deployability of Inter-As Spoofing Defenses

SMap: Internet-wide Scanning for Spoofing