4 ms·
Thank you for your insight. A bogus IP - one that no one is listening on - would also not ACK a RST, right? Doing a little googling this process seems to detec
by trotsky 16y ago
Thank you for your insight. A bogus IP - one that no one is listening on - would also not ACK a RST, right?
Doing a little googling this process seems to detect an attack (from a valid ip) that has been programmed to ignore RST - presumably because some intermediate ISPs (like tier1 borders) will detect a DDOS and forge a RST to attempt to mitigate them. Much like the firewall configs that circulated to defeat sandvine RST throttling of bittorrent.
- jjoe 16y agoA bogus host will obviously not respond to the RST but the last router-hop that receives the RST will (per RFC/protocol specs). The response is destination unreachable via ICMP. The ICMP unreachable packet is cheap (non-persistent) and requires no up-keep from the last hop to the bogus host. Most importantly, the ICMP unreachable packet requires no upkeep from the filtering node in EC2. Regards
- trotsky 16y agothanks much!