Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the...
Transcript of Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the...
![Page 1: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/1.jpg)
Spoofing and Denial of Service: A risk to the decentralized InternetDDoS: The real story with BCP38
Tom Paseka
GPF 2017
![Page 2: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/2.jpg)
Global Network
© 2017 Cloudflare Inc. All rights reserved. 2
![Page 3: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/3.jpg)
Content Neutral
© 2016 Cloudflare Inc. All rights reserved. 3
![Page 4: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/4.jpg)
Daily Attacks
© 2016 Cloudflare Inc. All rights reserved. 4
![Page 5: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/5.jpg)
We have to solve attacks
© 2016 Cloudflare Inc. All rights reserved. 5
![Page 6: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/6.jpg)
Record Breaking Attacks
Nickname Type Volume
SNMP Amp SNMP Amplification/Reflection 80Gbps
Spamhaus DNS Amplification/Reflection 300Gbps
"Winter of Attacks" Direct 400Gbps
IoT Direct 500Gbps+
© 2016 Cloudflare Inc. All rights reserved. 6
![Page 7: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/7.jpg)
Most big attacks have a few things in common
© 2016 Cloudflare Inc. All rights reserved. 7
![Page 8: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/8.jpg)
Flood of IP Packets
© 2016 Cloudflare Inc. All rights reserved. 8
![Page 9: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/9.jpg)
© 2016 Cloudflare Inc. All rights reserved. 9
![Page 10: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/10.jpg)
Spoofing Enables Impersonation
© 2016 Cloudflare Inc. All rights reserved. 10
![Page 11: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/11.jpg)
Spoofing? • Why is spoofing an
issue?
• This is my good friend Walt Wollny
• Let’s say, he was assaulted, but it was by masked assailant
• Without removing the mask, there can’t be legal retribution
© 2016 Cloudflare Inc. All rights reserved. 11
![Page 12: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/12.jpg)
May 2000: BCP38
© 2016 Cloudflare Inc. All rights reserved. 12
![Page 13: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/13.jpg)
Caida Spoofer Stats
© 2016 Cloudflare Inc. All rights reserved. 13
Updated: Feb 2017. Source: https://spoofer.caida.org
![Page 14: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/14.jpg)
Filter close to the source
© 2016 Cloudflare Inc. All rights reserved. 14
![Page 15: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/15.jpg)
IP Spoofing:
•Enables Impersonation
• Isn’t solved
© 2016 Cloudflare Inc. All rights reserved. 15
![Page 16: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/16.jpg)
IP Spoofing
1. Tracing back is impossible
2. Allows sophisticated attacks
© 2016 Cloudflare Inc. All rights reserved. 16
![Page 17: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/17.jpg)
IP Spoofing
1. Tracing back is impossible
2. Allows sophisticated attacks
© 2016 Cloudflare Inc. All rights reserved. 17
![Page 18: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/18.jpg)
Where did the attack come from?
© 2016 Cloudflare Inc. All rights reserved. 18
![Page 19: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/19.jpg)
Identifying interfaces
© 2016 Cloudflare Inc. All rights reserved. 19
![Page 20: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/20.jpg)
Identifying interfaces
© 2016 Cloudflare Inc. All rights reserved. 20
![Page 21: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/21.jpg)
What’s on the other side of the Cable?
© 2016 Cloudflare Inc. All rights reserved. 21
![Page 22: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/22.jpg)
1. Direct Peering
© 2016 Cloudflare Inc. All rights reserved. 22
![Page 23: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/23.jpg)
2. IXP / Internet Exchange Point
© 2016 Cloudflare Inc. All rights reserved. 23
3. Transit Provider
![Page 24: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/24.jpg)
2. IXP / Internet Exchange Point
© 2016 Cloudflare Inc. All rights reserved. 24
![Page 25: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/25.jpg)
2. IXP / Internet Exchange Point
© 2016 Cloudflare Inc. All rights reserved. 25
?.?.?.?
![Page 26: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/26.jpg)
3. Transit Provider
© 2016 Cloudflare Inc. All rights reserved. 26
Src ip = 8.8.8.8
![Page 27: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/27.jpg)
3. Transit Provider
© 2016 Cloudflare Inc. All rights reserved. 27
???Src ip = 8.8.8.8???
8.8.8.0/24
![Page 28: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/28.jpg)
Lack of Attribution
© 2016 Cloudflare Inc. All rights reserved. 28
![Page 29: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/29.jpg)
IP Spoofing
1. Tracing back is impossible
2. Allows sophisticated attacks
© 2016 Cloudflare Inc. All rights reserved. 29
![Page 30: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/30.jpg)
Amplification
© 2016 Cloudflare Inc. All rights reserved. 30
![Page 31: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/31.jpg)
March 2013: Spamhaus
© 2016 Cloudflare Inc. All rights reserved. 31
![Page 32: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/32.jpg)
Amplification is relatively easy to block….• …If you have the bandwidth. (few networks can absorb hundreds of Gbps)
• Block on firewall:
• src UDP/53 > deny
• Internet is fighting amplification sources:
• openresolverproject.org
• openntpproject.org
© 2016 Cloudflare Inc. All rights reserved. 32
![Page 33: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/33.jpg)
Source IP Addresses
© 2016 Cloudflare Inc. All rights reserved. 33
???Src ip = 8.8.8.8???
8.8.8.0/24
![Page 34: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/34.jpg)
Source IP Addresses
© 2016 Cloudflare Inc. All rights reserved. 34
https://xkcd.com/195/
![Page 35: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/35.jpg)
Source IP Addresses
© 2016 Cloudflare Inc. All rights reserved. 35
![Page 36: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/36.jpg)
Source IP Addresses
© 2016 Cloudflare Inc. All rights reserved. 36
![Page 37: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/37.jpg)
Dealing with Attacks
© 2016 Cloudflare Inc. All rights reserved. 37
![Page 38: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/38.jpg)
Null Routing
© 2016 Cloudflare Inc. All rights reserved. 38
![Page 39: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/39.jpg)
Null Routing• Probably the simplest way to deal with an attack
• You instruct your ISP not to route traffic for a single host, or a series of hosts in your network
• Except, you’ve just let the attacker win
• If you null route your service, you’ve taken it offline. Perhaps you have an advanced system and can quickly renumber, but the attacker can update their attack too
© 2016 Cloudflare Inc. All rights reserved. 39
![Page 40: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/40.jpg)
The only way to stay online is to absorb the attack
© 2016 Cloudflare Inc. All rights reserved. 40
![Page 41: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/41.jpg)
Receive and Process
© 2016 Cloudflare Inc. All rights reserved. 41
![Page 42: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/42.jpg)
Centralization
© 2016 Cloudflare Inc. All rights reserved. 42
![Page 43: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/43.jpg)
Solution?
© 2016 Cloudflare Inc. All rights reserved. 43
![Page 44: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/44.jpg)
Technical solutions to IP Spoofing have failed
© 2016 Cloudflare Inc. All rights reserved. 44
![Page 45: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/45.jpg)
Don’t just solve the IP Spoofing
© 2016 Cloudflare Inc. All rights reserved. 45
![Page 46: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/46.jpg)
Don’t just solve the IP Spoofing…
© 2016 Cloudflare Inc. All rights reserved. 46
…solve the attribution!
![Page 47: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/47.jpg)
© 2016 Cloudflare Inc. All rights reserved. 47
![Page 48: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/48.jpg)
Netflow• Opensource Toolsets are great
• Scales very well
• Privacy Concerns?
• This is very very simple data
• Rotate (delete) logs every few days
• Use a high sampling rate. 1/16,000
© 2016 Cloudflare Inc. All rights reserved. 48
![Page 49: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/49.jpg)
Netflow• H/W vendors must get better
• Netflow v9 supports src/dst MAC
• Which vendor supports it?
© 2016 Cloudflare Inc. All rights reserved. 49
Photo: The Simpsons/FOX
![Page 50: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/50.jpg)
NetFlow• It is EMBARRASING that a transit provider doesn’t know where packets ingress their
networks
• It’s even more embarrassing that service providers who have NetFlow equipment, be it open sourced / in house or provided by a vendor don’t know how to use it
• It’s also EMBARRASING that hardware vendors don’t support full NetFlow v9
• This needs to be resolved now
© 2016 Cloudflare Inc. All rights reserved. 50
![Page 51: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/51.jpg)
This is the first step
© 2016 Cloudflare Inc. All rights reserved. 51
![Page 52: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/52.jpg)
Attribution allows informed discussion
© 2016 Cloudflare Inc. All rights reserved. 52
![Page 53: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/53.jpg)
DDoS Causes centralization
© 2016 Cloudflare Inc. All rights reserved. 53
![Page 54: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/54.jpg)
To fix DDoS we need attribution
© 2016 Cloudflare Inc. All rights reserved. 54
![Page 55: Spoofing and Denial of Service: A risk to the ... · Spoofing and Denial of Service: A risk to the decentralized Internet DDoS: The real story with BCP38 Tom Paseka GPF 2017](https://reader035.fdocuments.in/reader035/viewer/2022071118/600ea2332c0e246fcc1618f8/html5/thumbnails/55.jpg)
To make the internet better for everyone
© 2016 Cloudflare Inc. All rights reserved. 55