Belgian ISP under 250 Gbps DDoS for days on end

Re:Belgian ISP under 250 Gbps DDoS for days on end by ancarda on Saturday September 18, 2021 @03:35PM (#28578637)

As far as I know, a lot of DDoS attacks use UDP amplification, which can be prevented if every ISP implements BCP 38; i.e. drop UDP traffic at the edge of their network that has a source that cannot have come from within their network.

EDIT: To clarify, this won't stop layer-7 based DDoS attacks, or anything that uses TCP (like SYN flooding). Just UDP amplification.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by MertsA on Saturday September 18, 2021 @04:34PM (#28579066)

>or anything that uses TCP (like SYN flooding)

Plenty of SYN floods spoof IP as well. If you don't need to get the response, and you're behind an ISP that doesn't bother blocking IP spoofing, why would you use your actual IP? It'll make it much harder to actually trace an attack to the actual device doing it. It won't work on devices behind NAT but neither will reflected UDP attacks.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by woutifier on Saturday September 18, 2021 @04:25PM (#28579020)

BCP 38 would stop SYN flooding if it is using source address spoofing. It won't stop any attack not based on IP spoofing though.

[ Parent | on HN ]