4 ms·
Yes it is possible. For example, uniformly randomized ports and addresses are a signature - if you study real traffic you find it doesn't look like that. A lo
by dgemm 10y ago
Yes it is possible. For example, uniformly randomized ports and addresses are a signature - if you study real traffic you find it doesn't look like that.
A lot of smart people have spent a lot of time thinking about this problem.
- lucb1e 10y agoWell sure it's a signature of being under attack, but is there also a solution to whom you are going to block and whom you are going to send a response to? That is not immediately obvious to me when packets have random source IPs, ports, query IDs and normal-looking domains.
- gbuk2013 10y agoSee my answer to brownbat's questions above.
- bogomipz 10y agoBut I don't believe that most of these DDOS providers "scrubbing services" handle this do they? It seems like a great fit for machine learning but in practice is anyone doing this? That's kind of what I was trying to ask.