Using the bit bucket to stymie virus traffic

Reverse Path Forwarding is a pretty useful feature common in routers these days; it allows you to drop packets when the route to the source address of the packet is something other than the interface on which the packet arrived. In other words, it's a fancy form of antispoofing that focuses on the source address. You can also do some quick and easy removal of unwanted packets using the destination address.

For the last several years, antispoofing access lists and firewall features have been quite common at the edge of the network and even at the border between the LAN at each site and the WAN. However, this doesn't help you when the problem -- for example, a virus that's spouting lots of garbage in an attempt to find and infect other hosts on your network -- is already on your LAN. What you want to be able to do is drop that traffic at the first opportunity, so that your backbone resources don't become congested. Also keep in mind that it's not just your backbone that suffers; your PCs and servers will also have to process every packet they get, which can slow them considerably.

For those of you with proxy servers, consider putting a static default route to the null0 interface on all your routers. In most cases, all the routers in your network communicate with each other via some routing protocol and know about all the routes in your network. However, if you're using a proxy server, you shouldn't need your default route as all traffic to the Internet will be

    Requires Free Membership to View

passed to the known internal address of the proxy server rather than simply following the default route to the nearest Internet gateway. Your proxy server, of course, will require a valid default route.

The advantage here is that when a virus starts trying to scan your network, any attempts made to connect to IP addresses you haven't actually configured will be routed to the bit bucket, which is in many cases much, much faster than using access lists or higher-layer filtering tools. Thus, you rapidly remove this traffic from the network before it ever touches the WAN.

About the author
Tom Lancaster, CCIE# 8829 CNX# 1105, is a consultant with 15 years of experience in the networking industry and co-author of several books on networking, most recently,
CCSP: Secure PIX and Secure VPN Study Guide published by Sybex.

This tip originally appeared on our sister site, SearchNetworking.com.

This was first published in January 2005

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.