A World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38
summary
Cloudflare analyzes 3 months of L4 DoS traces and builds spoofing detectors using unicast RPF plus anycast catchment learning and packet-signature matching; direct spoofed prefixes make up ~60–80% of attacker prefixes but only ~2–10% of volume, while reflection/amplification causes >50% of volume with peaks near 3.5 Tbps and surprisingly the top vector being UPnP amplification, not DNS. Detection works at scale only with a large anycast fabric, traceback succeeds for ~20% of neighbors, and universal mitigation requires wider BCP38 deployment.
AI-written summary · about
chapters (11)
- 0:00Introduction to IP spoofing
- 1:38Network layer attack scope
- 3:42Mechanics of spoofed attacks
- 5:12BCP 38 and validation efforts
- 8:26Detecting spoofed traffic
- 10:51URPF filtering limitations
- 14:13Anycast catchment detection
- 17:15Analyzing attack features
- 20:11Tracing and geographic data
- 23:15Conclusion and call to action
- 25:07Q&A session
related talks
41mAre DDoS attacks a threat to the decentralised internet?
26mMisuse of DNS, the Second Most Used Protocol
30mLessons From Defending The Indefensible
40mResearch on New Vectors of UDP-Based DDoS Amplification Attacks of IoT
25mDark Side of the DNS Force
52mInvestigating DDOS - Architecture Actors and Attribution
40mThe new reality of DDOS
33mCAP_NET_RAW And ARP Spoofing in Your Cluster: It's Going Downhill From Here