On Sep 30, 2014, at 3:49 PM, Lukas Tribus <[email protected]> wrote:
> BCP 38 is about ingress filtering on customer links, not egress filtering on > peers/upstream links, or am I missing something? Speaking more broadly, in a situation in which you know what destination prefixes should receive traffic across a given interface, you can implement ACLs to only allow traffic destined for those prefixes. However, operational entropy can be a challenge in terms of maintaining them; so, the QPPB hack that Dave Smith described, or using a VRF, can be useful. And even if you implement the ACLs, the traffic is still consuming peering-link bandwidth. Flow telemetry can also be used to determine if peers are dumping traffic, though the lack of MAC-address support in flow telemetry on popular Cisco platforms is frustrating in IX environments. ---------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> Equo ne credite, Teucri. -- Laocoön _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
