best practices make sure you only announce what you actually are responsible for filter what you receive from downstream filter what you receive from peers BCP38 - Network Ingress Filtering reverse path forwarding check pf(4) has "urpf-failed" for that asymetric routing problem filter as close to the edge as possible fight address spoofing