I've been reading a lot into these recent DDoS attacks and countermeasures. Even though syn cookies are a hack they fix the biggest exploitable resource hole in

I've been reading a lot into these recent DDoS attacks and countermeasures. Even though syn cookies are a hack they fix the biggest exploitable resource hole in TCP. It's now possible to initialize TCP using no stored state info but hardly anyone is doing it in practice. The biggest reason is that traditional NAT requires a separate conntrack state table. The big players (looking at you google, cloudflare) have solved this by using consistent hashing to load balance traffic but they're not sharing the code. Google made a show of good faith recently by releasing a comprehensive paper on how their load balancer works, hoping the open source movement will pull a mapreduce/hbase and built a replica off of it but this far it isn't happening. I think google gave up considering that they've seen how much money cloudflare makes selling the software as a service and now offer their own servers as DDoS protection. I've been looking deeply into the matter. The truth is that open load balancers relying on the kernel are not going to work. Someone needs to get started on this, and I've considered doing so myself but it's a big undertaking for a single dev