3 ms·
UDP spoofing is one thing but the latest and largest attacks are TCP based.
by Thaxll 10y ago
UDP spoofing is one thing but the latest and largest attacks are TCP based.
- majke 10y agoThis is a bold statement. First, one can spoof udp packets in the same way as tcp segments. Think syn or ack floods. Second the Krebs ddos is said to generate over 600 gigs of traffic but it was not necessarily with fully established tcp connections. It's unlikely it was with valid tcp connections. Let me give you a thought experiment: if you are flooded with 600 gigs of forged tcp packets, how do you know if the source ip's are spoofed or not? How do you know the ip in the src ip field belongs to the one that originated the packet?
- packetized 10y agoFlatly incorrect. The latest and largest attacks are generally UDP reflection attacks, with a smattering of TCP SYN flood & pure L7 attacks thrown in.
- dsp1234 10y agolatest and largest attacks Except for the latest and largest attacks: OVH @ near 1Tb/s in combined tcp_ack traffic on 2016/09/20 [0] When attackers have 150k+ comprimised hosts, with 1-30Mb/s each, there is no need for reflection/stealth/source spoofing/etc. At those levels, the attackers can just point them to an IP with 'normal' traffic and it's enough to be devastating. [0] - https://twitter.com/olesovhcom/status/778830571677978624 https://twitter.com/olesovhcom/status/778830571677978624
- packetized 10y agoApologies, I stand corrected.