> Why is this resource asymmetry unavoidable? It seems reasonable that a new protocol could solve it. Protocols are trying to avoid this problem. For TCP there

> Why is this resource asymmetry unavoidable? It seems reasonable that a new protocol could solve it. Protocols are trying to avoid this problem. For TCP there exist SYN cookies to reduce the amount of work a host has to do. For QUIC retry packets exist, as well as anti-amplification rules. However applying those mechanisms also has a cost. One is you still get computational cost not to zero, since you still have to receive and reject packets. And the other cost is now your legitimate users are experiencing a latency penality due to potentially requiring another round trip. The latter means you don't want to make those mechanisms the default, but rather use them selectively in certain situations. The former means even if you apply countermeasures you are not fully protected. If you get flooded purely by the bare amount of packets and the system stalls just from handling them, all the higher level mitigations won't work very well anymore. That's the difference between a DDoS and a DoS - the DDoS might not even need an asymetry in cost, it just brute-forces the system down.