Re:Belgian ISP under 250 Gbps DDoS for days on end
by johnklos on Saturday September 18, 2021 @03:50PM
(#28578741)
It wouldn't be hard.
If you can examine traffic on a network from which attacking traffic originates, you can see that it's coming from a phone.
Then you could see which app by either limiting or deleting apps one at a time, or you'd need two sources, then just see which apps the two sources have in common.
When you have 250 Gbps, it'd be simple to capture a fraction of a second's worth of traffic, then write a script to fire off emails to network admins of every IP involved and ask them to look in to it. Out of hundreds or thousands of messages, you'll get a few humans who'd look in to it and would be helpful.
If you can examine traffic on a network from which attacking traffic originates, you can see that it's coming from a phone.
Then you could see which app by either limiting or deleting apps one at a time, or you'd need two sources, then just see which apps the two sources have in common.
When you have 250 Gbps, it'd be simple to capture a fraction of a second's worth of traffic, then write a script to fire off emails to network admins of every IP involved and ask them to look in to it. Out of hundreds or thousands of messages, you'll get a few humans who'd look in to it and would be helpful.
I should know, because I've done this very thing.