3 ms·
"...very large L3/L4 floods aimed at the TCP protocol." If these attacks aren't simple floods of bogus TCP segments (SYN floods, etc) and they're actually comp
by EvanAnderson 10y ago
"...very large L3/L4 floods aimed at the TCP protocol."
If these attacks aren't simple floods of bogus TCP segments (SYN floods, etc) and they're actually completing the TCP handshake then tracing their source should be trivial (since, by definition, they couldn't use forged source addresses).
I'm assuming that they are just floods of bogus TCP segments w/ forged source addresses, which seems like a simple-enough "upgrade" that could have been deployed to existing botnets.
- throwwatgku 10y agoAnyone not using syn cookies is foolish these days. With the modified handshake a regular machine can handle 1Gbps+ of these packets
- majke 10y agoRight. Assuming it was SYN floods, and spoofed IP addresses, do you imply that Cloudflare should send back 400gbps of SYN+ACK syn cookies packets to the wide internet?