What is BCP 38?

BCP 38, formally RFC 2827, is a Best Current Practice published by the IETF in 2000. It describes a simple but powerful network-layer defense: ingress filtering. The core idea is that a router or firewall should examine the source IP address of every outbound packet it forwards. If the source address does not belong to the network prefix that the router expects to see on that interface, the packet is dropped. This prevents a customer or an attacker inside that network from sending traffic that claims to come from an IP address outside the allocated block.

Operators implement BCP 38 by configuring access control lists (ACLs) or using unicast Reverse Path Forwarding (uRPF) on customer-facing interfaces. The router checks the source against its routing table: if the best return path to that source address goes out the same interface, the packet is allowed; otherwise it is rejected. This stops most forms of IP spoofing, including amplification attacks such as DNS reflection and NTP amplification. BCP 38 is not a complete anti-spoofing solution (it does not fix transit-provider filtering gaps), but it is the foundational standard against which source-address validation is measured.

In the wider stack, BCP 38 sits at the boundary between network operations and security policy. It is referenced in numerous later RFCs, including BCP 84 (RFC 3704, which extends the method to asymmetric routing scenarios) and various DDoS mitigation guidelines. Adoption remains inconsistent, often because of operational complexity in multi-homed networks or fear of blocking legitimate traffic. Despite this, BCP 38 is the single most cost-effective control against source-address spoofing on the internet.