What is BCP38?

BCP38 is an IETF document (RFC 2827, Best Current Practice number 38) that recommends source address validation: filtering, at the network edge, any packet whose source address could not legitimately have come from that interface. The goal is to stop IP spoofing (forging someone else's source address), which underpins many reflection and amplification DDoS attacks. The rule is simple: if a packet enters the network with a source address outside the range assigned to that customer or link, it should be dropped.

What spoofing is and why it is dangerous

The source address in an IP header is not authenticated in any way, so a sender can forge it freely. An attacker exploits this by sending small queries to open services (DNS, NTP, memcached, SSDP) with the victim's address spoofed as the source. The servers reply with a much larger packet aimed at the victim, producing an amplification attack. Without source address validation, an operator unknowingly forwards spoofed traffic and becomes part of the attack infrastructure.

• Reflection and amplification attacks (DNS, NTP, memcached) require a forged source address to steer responses at the victim.
• Spoofing defeats attribution, because the true origin of the traffic is hidden behind a substituted address.
• A network that forwards spoofed traffic ends up on reputation lists and draws complaints from other operators.
• BCP38 does not protect your own network from being attacked; it prevents your network from being used to attack others.

How BCP38 is deployed: filters and uRPF

Source address validation is performed as close to the edge as possible, where the legitimate address range is known. Two methods are common in practice. The first is explicit ACLs on customer ports that permit only the prefixes assigned to that customer. The second is uRPF (Unicast Reverse Path Forwarding), described in RFC 3704, which automatically checks whether a return route to the source address exists via the ingress interface.

• Strict uRPF: a packet passes only if the best route to its source address points back out the interface it arrived on. This mode suits single-homed customer links.
• Loose uRPF: checks only that the source address exists somewhere in the routing table. It is safer with asymmetric routing, but weaker.
• Static ACLs: precise and predictable, but require manual updates whenever address assignments change.
• Filtering should be applied at the access edge (customer ports), not only at the transit boundary.

BCP38, MANRS, and its limits

Source address validation (anti-spoofing) is one of the four core actions of the MANRS initiative, alongside route filtering, coordination, and global validation (publishing your own routing policy in IRR and RPKI). BCP38 does have limits. Its effectiveness depends on adoption by as many networks as possible, and in environments with asymmetric routing or multihoming, strict uRPF can drop legitimate traffic. That is why filtering is done closest to the source, where the address range is unambiguous, while looser methods are used deeper in the network. BCP38 does not eliminate DDoS, but it cuts off spoofed traffic at the source and shrinks the scale of reflection attacks across the internet.

BCP38 in the AS202520 SkyPass network

As an operator, AS202520 SkyPass applies source address validation on customer ports at our PoPs in Warsaw and Wrocław. We combine prefix-based filters with uRPF wherever the topology allows. As a result, traffic entering our network and leaving toward the Polish internet exchanges (THINX, TPIX, WRIX, 1-IX) and IP transit does not carry forged source addresses. Validation is part of our MANRS-aligned approach to routing security and complements RPKI and the DDoS protection we offer to peering and transit customers.