Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: BCP38 making it work, solving problems

  • From: Paul Vixie
  • Date: Wed Oct 13 12:56:15 2004

> >How many people have seen "forged" spoofed IP addresses being used
> >for DOS attacks lately?

syn-flood protection, and random TCP ISS, are now common enough that
spoofed-source isn't effective for TCP flows.  if you want to bring down
somebody's web server then blackhats really do have to use real addresses.

however, if you just want to make their web server unreachable, then you
can either overload their DNS infrastructure or just congest their upstreams,
and you don't need to use real addresses for that.

i've never seen a dns attack that didn't have 50% or more packets coming
from spoofed sources, though due to loose-mode uRPF, most spoofed sources
in the last year or so have been from addresses for which a route exists.
-- 
Paul Vixie




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.