NETWORK SECURITY TACTICS
Using the bit bucket to stymie virus traffic
Tom Lancaster
01.19.2005
Rating: --- (out of 5)
|
Reverse Path Forwarding is a pretty useful feature common in routers these days; it allows you to drop packets when the route to the source address of the packet is something other than the interface on which the packet arrived. In other words, it's a fancy form of antispoofing that focuses on the source address. You can also do some quick and easy removal of unwanted packets using the destination address.
For the last several years, antispoofing access lists and firewall features have been quite common at the edge of the network and even at the border between the LAN at each site and the WAN. However, this doesn't help you when the problem -- for example, a virus that's spouting lots of garbage in an attempt to find and infect other hosts on your network -- is already on your LAN. What you want to be able to do is drop that traffic at the first opportunity, so that your backbone resources don't become congested. Also keep in mind that it's not just your backbone that suffers; your PCs and servers will also have to process every packet they get, which can slow them considerably.
For those of you with proxy servers, consider putting a static default route to the null0 interface on
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
all your routers. In most cases, all the routers in your network communicate with each other via some routing protocol and know about all the routes in your network. However, if you're using a proxy server, you shouldn't need your default route as all traffic to the Internet will be passed to the known internal address of the proxy server rather than simply following the default route to the nearest Internet gateway. Your proxy server, of course, will require a valid default route.
The advantage here is that when a virus starts trying to scan your network, any attempts made to connect to IP addresses you haven't actually configured will be routed to the bit bucket, which is in many cases much, much faster than using access lists or higher-layer filtering tools. Thus, you rapidly remove this traffic from the network before it ever touches the WAN.
About the author
Tom Lancaster, CCIE# 8829 CNX# 1105, is a consultant with 15 years of experience in the networking industry and co-author of several books on networking, most recently, CCSP: Secure PIX and Secure VPN Study Guide published by Sybex.
This tip originally appeared on our sister site, SearchNetworking.com.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
