Belgian ISP under 250 Gbps DDoS for days on end

Re:Belgian ISP under 250 Gbps DDoS for days on end by nickthemagicman on Sunday September 19, 2021 @01:17PM (#28586035)

Yep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails.

Most machines don't have UDP services open to accept packets.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by MrStonedOne on Sunday September 19, 2021 @01:25PM (#28586118)

all machines need udp opened to get response from ntp and dns.

moving these to tcp would actually seriously help with filtering ddos, but good luck.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by nickthemagicman on Wednesday September 22, 2021 @12:14AM (#28613049)

Yeah but as I understand it, Port 22 doesn't just sit open on a machine waiting for any connection.

Running a quick netstat -p udp doesn't show any UDP entrys with LISTENING status.

[ Parent | on HN ]