3 ms·
if you are sending packets but don't care about the reply, you can spoof the from header. The other form of ddos is udp amplification. you send a packet to a l
by MrStonedOne 5y ago
if you are sending packets but don't care about the reply, you can spoof the from header.
The other form of ddos is udp amplification. you send a packet to a legit host and spoof the target ip as the from ip, the reply goes to your target and bam, ddos.
- kazen44 5y agothis could be solved in ipv6 by implementing ipsec in AH mode.
- nickthemagicman 5y agoYep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails. Most machines don't have UDP services open to accept packets.
- MrStonedOne 5y agoall machines need udp opened to get response from ntp and dns. moving these to tcp would actually seriously help with filtering ddos, but good luck.
- nickthemagicman 5y agoYeah but as I understand it, Port 22 doesn't just sit open on a machine waiting for any connection. Running a quick netstat -p udp doesn't show any UDP entrys with LISTENING status.