Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: DDos syn attack

  • From: Avleen Vig
  • Date: Wed Jan 01 22:32:42 2003

On Mon, 30 Dec 2002, Chris Wedgwood wrote:

> maybe this could help find the attacking nwtwork?  assuming people are
> using local DNS servers?
> under attack you could sporadically 'lie' about the result... and log
> to whom you lied to... all the time looking for changes in the DDoS
> target
> a fair amount work perhaps...

This would be nice. Sort of like using different email addresses for each
site you hand them to and watching to see where the spam comes in from :-)

Tracing back an IP from bind logs to see which name servers looked up an
attacked address immediately before the attack started. This at leads to
the offender's ISP which is a good start.




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.