Inferring the Deployment of Inbound Source Address Validation Using DNS Resolvers

Maciej Korczyński (1, 2, 3) , Yevheniya Nosyk (2, 3, 4) , Qasim Lone (5) , Marcin Skwarek (1, 2, 3) , Baptiste Jonglez (1, 2, 6, 3) , Andrzej Duda (1, 2, 3)

1 Grenoble INP - Institut polytechnique de Grenoble - Grenoble Institute of Technology
2 Drakkar
3 LIG - Laboratoire d'Informatique de Grenoble
4 UGA - Université Grenoble Alpes
5 TU Delft - Delft University of Technology
6 POLARIS - Performance analysis and optimization of LARge Infrastructures and Systems

This paper reports on the first Internet-wide active measurement study to enumerate networks not filtering incoming packets based on their source address. Our method identifies closed and open DNS resolvers handling requests from the outside of the network with the source address in the prefix of the tested network. The study gives the most complete picture of the inbound Source Address Validation deployment at network providers: 32,673 IPv4 ASes and 197,641 IPv4 BGP prefixes are vulnerable to spoofing of inbound traffic.

Domaines: Réseaux et télécommunications [cs.NI]

Maciej Korczyński, Yevheniya Nosyk, Qasim Lone, Marcin Skwarek, Baptiste Jonglez, et al.. Inferring the Deployment of Inbound Source Address Validation Using DNS Resolvers. ANRW 2020 - Applied Networking Research Workshop, Jul 2020, Madrid, Spain. pp.9-11, ⟨10.1145/3404868.3406668⟩. ⟨hal-02894078⟩