News for hackers. Stuff that matters.

A comment on The Daily DDoS: Ten Days of Massive Attacks.

Re:The Daily DDoS: Ten Days of Massive Attacks by EvanAnderson on Friday December 02, 2016 @08:52AM (#13088499)
"...very large L3/L4 floods aimed at the TCP protocol."

If these attacks aren't simple floods of bogus TCP segments (SYN floods, etc) and they're actually completing the TCP handshake then tracing their source should be trivial (since, by definition, they couldn't use forged source addresses).

I'm assuming that they are just floods of bogus TCP segments w/ forged source addresses, which seems like a simple-enough "upgrade" that could have been deployed to existing botnets.

[ Parent | on HN ]
Re:The Daily DDoS: Ten Days of Massive Attacks by throwwatgku on Friday December 02, 2016 @09:38AM (#13088818)
Anyone not using syn cookies is foolish these days. With the modified handshake a regular machine can handle 1Gbps+ of these packets
[ Parent | on HN ]
Re:The Daily DDoS: Ten Days of Massive Attacks by majke on Friday December 02, 2016 @12:23PM (#13090470)
Right. Assuming it was SYN floods, and spoofed IP addresses, do you imply that Cloudflare should send back 400gbps of SYN+ACK syn cookies packets to the wide internet?
[ Parent | on HN ]