Belgian ISP under 250 Gbps DDoS for days on end

Re:Belgian ISP under 250 Gbps DDoS for days on end by MrStonedOne on Saturday September 18, 2021 @05:04PM (#28579280)

if you are sending packets but don't care about the reply, you can spoof the from header.

The other form of ddos is udp amplification. you send a packet to a legit host and spoof the target ip as the from ip, the reply goes to your target and bam, ddos.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by nickthemagicman on Sunday September 19, 2021 @01:17PM (#28586035)

Yep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails.

Most machines don't have UDP services open to accept packets.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by MrStonedOne on Sunday September 19, 2021 @01:25PM (#28586118)

all machines need udp opened to get response from ntp and dns.

moving these to tcp would actually seriously help with filtering ddos, but good luck.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by nickthemagicman on Wednesday September 22, 2021 @12:14AM (#28613049)

Yeah but as I understand it, Port 22 doesn't just sit open on a machine waiting for any connection.

Running a quick netstat -p udp doesn't show any UDP entrys with LISTENING status.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by kazen44 on Saturday September 18, 2021 @05:50PM (#28579665)

this could be solved in ipv6 by implementing ipsec in AH mode.

[ Parent | on HN ]