2 ms·

I don't understand how this allowed them to conceal their location. Surely whatever connection was being used to send commands could be traced back to the attac

• forgottenpass 9y ago
  The spoofed traffic theoretically could be traced back, but at the level of internet routing it would impose a huge cooperation and monitoring requirements on a number of networks. (As we can presume the origin network that's letting spoofed traffic onto the internet isn't going to notice, and/or would be uncooperative to someone investigating the source of the traffic.) And that monitoring would have to have been active while the traffic spoofing was ongoing. If an ISP has confidence that incoming traffic is spoofed they'll just drop the packets instead of routing. So we're now talking about storing metadata on traffic for after-the-fact analysis, which could be prohibitively expensive considering the amount of traffic transiting networks, and has privacy implications.