3 ms·
This is an attack over UDP. The source address is likely spoofed. Simply blocking an IP will do nothing but banning somebody not related to the attack at all.
by ddalex 10y ago
This is an attack over UDP. The source address is likely spoofed. Simply blocking an IP will do nothing but banning somebody not related to the attack at all.
- qeternity 10y agoI don't think you understand how spoofing works. And no, this attack was not spoofed. It was just hundreds of thousands of IoT devices each pushing a small amount of traffic (0.5-1mbps).
- niij 10y agoI don't believe this Mirai IoT attack is using spoofing. But on the topic of spoofing: if an ISP doesn't follow BCP38 and allows spoofed packets to leave their network, then there is truly no traceability in where a packet came from. See this talk from Strangeloop about how spoofed packets are a problem [0] [0]: https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ https://idea.popcount.org/2016-09-20-strange-loop---ip-spoof...
- lttlrck 10y agoThere are still behind NAT so they are using the address assigned by the ISP. UPnP sets up the forwarding rule it's doesn't give direct access.