computer science

Ingress filtering

Ingress filtering is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Ingress filtering rather than just read about it. In short: In computer networking, ingress filtering is a technique used to ensure that incoming packets are actually from the networks from which they claim to originate. This can be used as a countermeasure against various spoofing attacks where the attacker's packets contain fake IP addresses.

Key takeaways

Ingress filtering belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Ingress filtering to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Ingress filtering from memory before moving on to harder problems.

Reference excerpt

In computer networking, ingress filtering is a technique used to ensure that incoming packets are actually from the networks from which they claim to originate. This can be used as a countermeasure against various spoofing attacks where the attacker's packets contain fake IP addresses. Spoofing is often used in denial-of-service attacks, and mitigating these is a primary application of ingress filtering.

Problem Networks receive packets from other networks. Normally a packet will contain the IP address of the computer that originally sent it. This allows devices in the receiving network to know where it came from, allowing a reply to be routed back (amongst other things), except when IP addresses are used through a proxy or a spoofed IP address, which does not pinpoint a specific user within that pool of users. A sender IP address can be faked (spoofed), characterizing a spoofing attack. This disguises the origin of packets sent, for example in a denial-of-service attack. The same holds true for proxies, although in a different manner than IP spoofing.

Potential solutions One potential solution involves implementing the use of intermediate Internet gateways (i.e., those servers connecting disparate networks along the path followed by any given packet) filtering or denying any packet deemed to be illegitimate. The gateway processing the packet might simply ignore the packet completely, or where possible, it might send a packet back to the sender relaying a message that the illegitimate packet has been denied. Host intrusion prevention systems (HIPS) are one example of technical engineering applications that help to identify, prevent and/or deter unwanted, unsuspected or suspicious events and intrusions. Any router that implements ingress filtering checks the source IP field of IP packets it receives and drops packets if the packets don't have an IP address in the IP address block to which the interface is connected. This may not be possible if the end host is multi-homed and also sends transit network traffic. In ingress filtering, packets coming into the network are filtered if the network sending it should not send packets from the originating IP address(es). If the end host is a stub network or host, the router needs to filter all IP packets that have, as the source IP, private addresses (RFC 1918), bogon addresses or addresses that do not have the same network address as the interface.

Networks Network ingress filtering is a packet filtering technique used by many Internet service providers to try to prevent IP address spoofing of Internet traffic, and thus indirectly combat various types of net abuse by making Internet traffic traceable to its source. Network ingress filtering makes it much easier to track denial-of-service attacks to their source(s) so they can be fixed. Network ingress filtering is a good neighbor policy that relies on cooperation between ISPs for their mutual benefit. The best current practices for network ingress filtering are documented by the Internet Engineering Task Force in BCP 38 and 84, which are defined by RFC 2827 and RFC 3704, respectively. BCP 84 recommends that upstream providers of IP connectivity filter packets entering their networks from downstream customers, and discard any packets which have a source address that is not allocated to that customer. There are many possible ways of implementing this policy; one common mechanism is to enable reverse-path forwarding on links to customers, which will indirectly apply this policy based on the provider's route filtering of their customers' route announcements.

Deployment As of 2012, one report suggests that, contrary to general opinion about the lack of BCP 38 deployment, some 80% of the Internet (by various measures) were already applying anti-spoofing packet filtering in their networks. David A. Wheeler is in favor of passing a law requiring 100% of all ISPs to implement network ingress filtering as defined in IETF BCP 38. In the US, presumably the FCC would enforce this law.

See also Egress filtering Ingress cancellation Prefix hijacking

References

External links RFC 2827 - Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing (BCP 38) RFC 3704 Ingress Filtering for Multihomed Networks (BCP 84) Jay R. Ashworth. "BCP38.info". Information on BCP 38 » RFC Editor Information on BCP 84 » RFC Editor Routing MANRS

Worked examples

Example 1 — a first encounter with Ingress filtering

Start with the simplest possible case. Write down what Ingress filtering claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Ingress filtering before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Ingress filtering ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Ingress filtering

In research: Ingress filtering appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Ingress filtering in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Ingress filtering is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, so understanding it makes those chapters shorter.
In everyday life: Look for Ingress filtering outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Ingress filtering in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Ingress filtering means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Ingress filtering out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Ingress filtering in simple terms?

Why does Ingress filtering matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Ingress filtering?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Ingress filtering.