2) Inappropriate IP addresses

• By using Inappropriate IP addresses, some of
• the attackers remain hidden & with help of other hosts to create a distributed denial-of-service(DDoS) attack.
• Best Layer-3 security practice is use of ACL to filter packets containing ip address which are not appropriate.
• Router should also filter packets that are bogus or inappropriate.
• ex, a packet should never have a broadcast or multicast source ip address in normal use.
• Router should never receive a packet from an ISP with that Packet's source ip address being a private network per RFC 1918.
• Additionally the same router should not receive packets sourced from IP addresses in ranges currently unallocated by IANA.
• These types of ip addresses are frequently called bogons (unallocated ip addresses ranges of IANA).
• Filter these bogons by
• Creating an ACL to match these bogon ip addresses (regularly updated based on changes in IANA's assigned prefixes).
• Use freeware called the Router Audit Tool(RAT) that makes recommendations for router security, including bogon ACLs.
• Also use the Cisco IOS AutoSecure feature.
• It automatically configures ACLs to prevent the use of such  bogus ip addressess

General layer 3 Security considerations

1) Smurf Attacks:

• When a host sends a large number of ICMP echo request with atypical(not related) IP address in the packet & destination address is a subnet broadcast address (also known as a directed broadcast address).
• Routers forward these packets normally to the final router connected to the destination subnet.
• This final router forwards the packets to the LAN as broadcast (send a copy to every host on that subnet)
• Other feature of a smurf attack is that the source IP address of the packet sent by the attacker is the ip address of the attacked host.
• Several solutions to this problem are:
• IOS v12.0, default each interface to use the no ip directed-broadcast which prevent the router from forwarding the broadcast onto the LAN
• Unicast a Reverse Path Forwarding (uRPF) check could be enabled using the ip verify unicast source reachable-via {rx | any } [allow-default] [allow-self-ping[ [list] interface sub command.
• This command tells cisco ios to examine the source IP address of incoming packets on that interface.
• CEF must be enabled for uRPF to work.
• Strict RPF:
• Using the rx  keyword, the router checks to see if the the matching route uses an outgoing interface that is the same interface on which the packet was received.
• Loose RPF:
• Using the any keyword, the router checks for any route that can be used to reach the source ip address.
• These commands can also ignore default routes when it performs the check (default) or use default routes when performing the check by including the allow-default keyword.
• allow-default command can trigger a ping(RPF) to the source to verify connectivity.
• This RPF check is limited by a ACL.
• Fraggle Attack use similar logic as smurf attacks, but insted of ICMP, fraggle attacks use the UDP Echo application.
• These attacks can be defeated using the same options as listed for smurf attacks.

Basic Terminology

IP addresses: Each machine on the internet is assigned a unique address called an IP address.
Domain Names: Human readable ip addresses are called domain names.
Protocols: Predefined way that someone(program or person) who wants to use a service, talks with that service.
IP:  the main delivery system for information over the internet
TCP(transmission control protocol): used to break apart and rebuild information that travels over the intenet
HTTP(Hyper Text Transfer Protocol): used for webpages
FTP: used to download & upload files
UDP(User Datagram Protocol): used for information that require no response, such as streaming audio & video
ICMP(Internet Control Message Protocol): used by a router to exchange the information with other routers
SMTP(Simple Mail Transport Protocol): used to send text based information
SNMP(Simple Network Management Protocol): Used to collect system information from a remote computer.
Telnet: Used to perform commands on a remote computer

ACCESS CONTROL LIST

• 
  

• For protecting routers, Layer 3 forwarding (IP routing), and the layer 3 control plane(routing protocols), additionally RFCs 2827 & 3704 outline other types of protections
• RFC 2827 addresses issues with
• the use of the IP source & destination fields in the IP header to form some kind of attack
• RFC 3704 details some issues related to how the tools of 2827 may be best deployed over the internet.
•