Internet service providers to try to prevent IP address spoofing of Internet traffic, and thus indirectly combat various types of net abuse by making Internet traffic traceable to its source. Network ingress filtering makes it much easier to track denial-of-service attacks to their source(s) so they can be fixed. Network ingress filtering is a good neighbor policy that relies on cooperation between ISPs for their mutual benefit. The best current practices for network ingress filtering are documented by the Internet Engineering Task Force in BCP 38 and 84, which are defined by RFC 2827 and RFC 3704, respectively. BCP 84 recommends that upstream providers of IP connectivity filter packets entering their networks from downstream customers, and discard any packets which have a source address that is not allocated to that customer. There are many possible ways of implementing this policy; one common mechanism is to enable reverse-path forwarding on links to customers, which will indirectly apply this policy based on the provider's route filtering of their customers' route announcements. Deployment As of 2012, one report suggests that, contrary to general opinion about the lack of BCP 38 deployment, some 80% of the Internet (by various measures) were already applying anti-spoofing packet filtering in their networks. At least one computer security expert is in favor of passing a law requiring 100% of all ISPs to implement network ingress filtering as defined in IETF BCP 38. In the US, presumably the FCC would enforce this law. See also Egress filtering Ingress cancellation Prefix hijacking References External links RFC 2827 - Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing (BCP 38) RFC 3704 Ingress Filtering for Multihomed Networks (BCP 84) IETF's BCP Index Routing MANRS Computer network security