Anti-spoofing and BCP38
Most large attacks on the internet are possible because some networks let their customers send packets claiming to be from someone else. Not being one of those networks — and not having customers who are — is a basic duty.
Packet source addresses are not verified by default — a machine can put any address it likes in the ‘from’ field. That single fact enables reflection and amplification attacks, where an attacker sends requests that appear to come from a victim, and the replies flood the victim instead. BCP38 is the long-standing best practice that says: drop packets leaving your network whose source address could not legitimately be there.
Why spoofing is the root of so much
A spoofed request to an open service — a resolver, an NTP server, a misconfigured game server — produces a much larger reply sent to the forged source. Multiply by thousands and that is a volumetric DDoS, made possible entirely because the source address was a lie. Stop the lie and the attack class largely collapses.
On your own servers
Your machines should only ever send packets from their own addresses. Egress filtering — see controlling outbound traffic — enforces that, so a compromised service on your box cannot be used to spoof attacks on others. It also means you do not earn the abuse notices that follow.
Do not run open reflectors
The other half is not offering the services that spoofing abuses. Keep resolvers, NTP and similar closed to the public — see running your own resolver. An open resolver on your server is a weapon handed to attackers.
Our side of it
We apply source-address validation at our edge, so traffic leaving our network carries honest source addresses, and we act on reports of spoofing from within it. It is part of being a responsible network, not an optional extra — see how DDoS filtering works here.
It protects everyone, including you
Anti-spoofing is unusual among security measures: most of its benefit goes to other networks. Doing it anyway is what keeps the internet usable — and a provider that does not is one whose addresses end up on blocklists.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base