When considering ingress filtering, why should all inbound packets be dropped if they contain a source address from within the protected network address space? (A) The packets are probably…

Question

Options

• AA and B
• BB and C
• CB and D
• DA and D

• A
  6% (2)
• B
  78% (25)
• C
  13% (4)
• D
  3% (1)

Explanation

Ingress filtering is a border security technique where routers/firewalls drop inbound packets whose source IP addresses are logically impossible or suspicious. If a packet arrives from the Internet claiming to originate from an internal (private) IP address, there are two plausible explanations: (B) The packets may have been accidentally routed onto the Internet - internal traffic that leaked out and looped back; or (C) The packets may be deliberately spoofed by an attacker - a common technique in IP spoofing attacks where an attacker fakes an internal source address to impersonate a trusted host or bypass access controls. Option A (corruption) is incorrect because corruption would not consistently produce valid internal source addresses. Option D (excess fragmentation) is a separate concern unrelated to source address legitimacy. RFC 2827 (BCP 38) formalizes this ingress filtering best practice for exactly these reasons.

No community discussion yet for this question.