Which ISP-level practice prevents spoofed source addresses from Internet traffic?

Which ISP-level practice prevents spoofed source addresses from Internet traffic?

• A. Ingress filtering
• B. Egress filtering
• C. TCP Intercept
• D. Wavelet-Based Signal Analysis

Answer: (A)

Filtering inbound traffic at the edge of the ISP’s network to validate the source address is the key idea. Ingress filtering checks packets as they come from the Internet into the ISP and drops any that claim to originate from a block that doesn’t belong to the interface they arrived on. By enforcing that the source IP matches the networks the ISP has routes for, spoofed addresses can’t be used to masquerade traffic, reducing spoofing-based abuse and reflection attacks. The other options don’t address this inbound source verification: egress filtering would apply to traffic leaving the ISP, and the remaining choices are not techniques for IP address validation at the network edge.

Filtering inbound traffic at the edge of the ISP’s network to validate the source address is the key idea. Ingress filtering checks packets as they come from the Internet into the ISP and drops any that claim to originate from a block that doesn’t belong to the interface they arrived on. By enforcing that the source IP matches the networks the ISP has routes for, spoofed addresses can’t be used to masquerade traffic, reducing spoofing-based abuse and reflection attacks. The other options don’t address this inbound source verification: egress filtering would apply to traffic leaving the ISP, and the remaining choices are not techniques for IP address validation at the network edge.