Doesn't it also mean addresses serving as the source of an attack become more disposable?

The hackers still have to compromise the host right?

if you are sending packets but don't care about the reply, you can spoof the from header.

The other form of ddos is udp amplification. you send a packet to a legit host and spoof the target ip as the from ip, the reply goes to your target and bam, ddos.

Yep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails.

Most machines don't have UDP services open to accept packets.

all machines need udp opened to get response from ntp and dns.

moving these to tcp would actually seriously help with filtering ddos, but good luck.

Yeah but as I understand it, Port 22 doesn't just sit open on a machine waiting for any connection.

Running a quick netstat -p udp doesn't show any UDP entrys with LISTENING status.

this could be solved in ipv6 by implementing ipsec in AH mode.

Most devices are configured to randomize part of the v6 address for privacy so you can no longer see more info than ipv4 would show.

Ban the prefix instead.

A trillion hosts.deny entries?

How many hackers would it take to compromise a trillion hosts?

the hackers are better than I thought!