Detecting Non-Spoofed Traffic at ISP Ingress Points#

Petros Gigis (University College London)

• Why: "Traffic from source X arriving at the wrong ingress" is a daily operator puzzle: is it a route leak, a BGP hijack, a commercial-agreement mismatch, or just spoofed background noise? This talk offers a genuinely clever, deployable test to tell them apart — a small research idea with unusually direct operational payoff.
• What: Penny, a traffic checker that distinguishes non-spoofed traffic aggregates arriving at unexpected ingress points from spoofed ones, with a planned open-source release (openPenny). Beyond the core detection, the tool is positioned to surface routing misconfigurations, BGP-hijack indications, upstream/downstream packet loss, abruptly terminated TCP flows, and load-balancing behaviour (write-up based on the abstract and program page summary).
• How: The mechanism is elegant: when new traffic appears at an unexpected router, drop a few TCP packets. Non-spoofed flows retransmit; spoofed ones don't. The research contribution is making that robust — minimising harm to legitimate flows, tolerating path changes and remote loss that look like drops, and resisting spoofers who adapt to evade the probe.
• Where applicable: Any ISP or large operator with multiple ingress points and BGP-speaking neighbors; the technique is TCP-dependent and ingress-diversity-dependent, so it fits transit/peering-heavy networks best. Research-stage (UCL) but explicitly aimed at open-source operator adoption.