What is BCP38?

BCP38 (Best Current Practice 38, RFC 2827) says networks should drop packets from customers whose source address the network didn't assign to them.

The idea is simple. An ISP knows which addresses each customer was given, so at the edge of its network it can check every packet arriving from that customer: if the source address isn't one of the customer's, the packet is forged or misrouted, and it's dropped. This is called ingress filtering or source address validation. It's done with access lists on the customer-facing interface, or automatically with unicast reverse-path forwarding (uRPF), which accepts a packet only if the route back to its source points out of the interface it arrived on; the Linux equivalent is rp_filter.

Its purpose is to stop spoofing: attacks that fake their source address, such as reflection and amplification DDoS, rely on networks that don't filter. Filtering at every edge is one of the MANRS actions for network operators. You also meet it from the customer's side, and it's the main difficulty of having two ISPs: if a reply carrying ISP 2's address leaves through ISP 1, ISP 1 drops it, so a dual-ISP router has to send traffic out through the ISP that owns its source address. The Two internet connections on Debian lesson shows exactly that, with an ISP that filters like this.