All DDoS Definitions
DDoS Testing Definition

BCP 38 (Ingress Filtering)

BCP 38 (RFC 2827) is an ingress-filtering standard and defensive control, foundational to the reflection attacks a thorough DDoS test is built to exercise. It directs network operators to drop packets whose source IP could not legitimately originate from the interface they arrive on, so a host cannot forge an arbitrary source address. Universal deployment would eliminate the spoofing that every reflection and amplification attack depends on.

BCP 38: ingress filtering blocks source spoofing Customer network assigned prefix 203.0.113.0/24 Packet src 203.0.113.5 belongs to this interface Packet src 198.51.100.9 forged victim address Provider edge BCP 38 ingress filter source valid for this interface? src in range src not in range Forwarded to the internet Dropped cannot spoof Spoofing is what every reflection and amplification flood depends on; BCP 38 removes it at the source. A test cannot validate your own BCP 38, but it exercises the reflection floods unfiltered spoofing enables. BlackNeuron™
BCP 38 ingress filtering forwards a packet whose source belongs to the customer prefix and drops one carrying a forged victim source address that could not originate on that interface

Why it matters in DDoS testing

BCP 38 is the defense that fails by being someone else's responsibility: it protects the internet at large, not the network that deploys it. A test cannot validate your own BCP 38 against your origin, but it does exercise the downstream consequence, the reflection and amplification floods that exist precisely because spoofing remains possible across much of the internet. Understanding that gap shapes which volumetric vectors must be tested.

For the amplification vectors spoofing enables, see understanding DDoS attack vectors.