3 ms·
Unless you keep propagating "upstream" and the message gets to the "source" ISP, and they block the actual misbehaving user/account. For all we know, they can k
by zo1 11y ago
Unless you keep propagating "upstream" and the message gets to the "source" ISP, and they block the actual misbehaving user/account. For all we know, they can kick them off the network after sufficient transgression, and ban their account at the hardware ADSL level (assuming that's what it is). This also presumes the ISP is willing to implement such a feature, and kick-off their paying (albeit infected) users.
I don't know much about this stuff, so I'm extrapolating and pseudo-solving.
- toast0 11y agoUsually there's a lot of diversity in the immediate source of the traffic. If it's a volumetric attack, the immediate source is the misconfigured servers that spoofed packets are being sent to. If it's an in band attack, the immediate source is usually botnet members, but occasionally regular browsers being served bad scripts by a compromised or mitmed site. You could work to notify the network owners, but it's whack-a-mole; even with strong efforts there are enough DNS and ntp servers out there configured to generate a pretty big reflection.