Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Is there a line of defense against Distributed Reflective attacks?

  • From: Christopher L. Morrow
  • Date: Thu Jan 16 23:01:34 2003


On Thu, 16 Jan 2003, hc wrote:

>
> This type of DRDOS (Distributed Reflective Denial of Service Attack) is
> well commonly-known to both network operators, and as well as many
> script-kiddies.
>
> By forging the source IP address of the attack to the victim's IP, and
> attacking internet backbone routers, this creates an immediate,
> devastating, yet very effective attack. Backbone routers, seeing this as
> legitimate packets simply reply back to the victim.
>
> I guess the question is, what are the internet backbones doing these
> days to evade the outcome of reflected DoS attacks? Are they simply
> going to let their routers be the middleman to kick off innocent hosts?
>
> SYN cookies and various other methods to control DoS attacks are only

Because syn cookies are available on routing gear??? Either way syn
cookies are not going to keep the device from sending a 'syn-ack' to the
'originating host'.

> used by smart ISP's.. And considering most ISP's do not even care about
> egress filters, I don't believe any of these methods will work for quite
> some time to come.
>
> -hc





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.