Skip to content

SAVNET Source Address Validation — draft-ietf-savnet-general-sav-capabilities, draft-ietf-savnet-intra-domain-architecture, draft-ietf-savnet-inter-domain-architecture#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

  • Tier: Core
  • Why: Source-address spoofing underlies reflection/amplification DDoS and is still routinely mitigated with unreliable, manually-maintained ACLs or uRPF heuristics. SAVNET is the WG working an actual generic architecture, both within and across autonomous systems.
  • What: general-sav-capabilities proposes SAV as a first-class data-plane capability rather than a byproduct of FIB-based uRPF, widening deployable scenarios and traffic-handling policy. intra-domain-architecture gives a generic framework so a single domain's SAV mechanisms can share validation rules and improve accuracy over uRPF-only approaches. inter-domain-architecture extends the same idea across AS boundaries, letting ASes exchange SAV-specific information to generate more trustworthy rules than routing-table inference alone provides. (from abstract only)
  • How: Instead of deriving filters solely from existing routing state, SAVNET routers exchange SAV-specific signaling (intra-domain) or AS-level SAV information (inter-domain) to build filters that handle asymmetric routing correctly, with graceful fallback to general routing information during partial deployment.
  • Where applicable: General network operator deployments; inter-domain SAV is explicitly designed for incremental rollout, so partial adoption still helps.