Start by making sure your RAS users and direct customers (your network's
edge) can only output packets that contain their valid source address.
If everyone did this, all of the world's problems would go away; Ozone
depletion, world hunger, that silly rain forest thing, Smurfs and DoS
and maybe even Microsoft!
David Van Allen - FASTNET(tm) / You Tools Corporation
email@example.com (888)321-FAST(3278) http://www.fast.net
FASTNET - Business and Personal Internet Solutions
We prevent ANY packets to or from our network with a broadcast
address. We don't filter on a per-machine basis for address
spoofing, but ALL packets leaving our network must have a valid
address on our network. Basically, one user on our network can spoof
another user on our network, but no users can spoof addresses that
are not on our network.