BCP 38 (Source Address Validation)
BCP 38, published as RFC 2827 (with RFC 3704 extending it to multihomed networks), is the Internet Engineering Task Force's best-practice recommendation that network operators filter outbound traffic at the network edge, dropping any packet whose source address doesn't belong to a prefix that network is actually authorized to originate. Without this ingress filtering, a host on any network can send a packet claiming almost any source address it likes, which is exactly what spoofed-source denial-of-service and reflection/amplification attacks depend on: the attacker sends small requests with a victim's address forged as the source, and every reply goes to the victim instead of the attacker. BCP 38 doesn't stop an attacker from spoofing an address that is legitimately inside their own permitted range, and it only works when deployed broadly -- a network that filters its own outbound spoofed traffic protects the rest of the internet from attacks it would have originated, not necessarily itself from attacks originating elsewhere. Adoption remains uneven decades after publication, since the benefit of filtering accrues to the rest of the internet rather than to the operator doing the work.
By AdminKit team, Netbase JSC · Updated