2 ms·
> syn-spoofing-flooding tools lack some TCP options Four years ago my hobby server on a DSL link got attacked in a SYN reflection attack and it went on for a l
by m3047 4y ago
> syn-spoofing-flooding tools lack some TCP options
Four years ago my hobby server on a DSL link got attacked in a SYN reflection attack and it went on for a long time. I took the "usual measures" and it made no difference. (How much nutritional value are they getting here?) My upstream was aware, and had checked to make sure it wasn't inside their DC.
It became a diversion to investigate out of boredom. Finally, statistical analysis of TTLs revealed a pattern. I wrote a Python script to reveal the pattern (gotta love Scapy!) and make some guesses about the actual number of hops and sent that to my upstream. They sent it to their upstream. A few weeks later the Chinese arrested a few people.
- LinuxBender 4y agoA few weeks later the Chinese arrested a few people. That's impressive. I've never been able to get their ISP's to respond to me, even after having coworkers write emails in traditional Chinese. The only time I had any success was contacting the CCP and suggesting someone was spreading democracy and talking bad about them and those networks would go silent but they would still never reply to me.
- m3047 4y agoI won't crame credit, as it would be foolish to do so. If they were worth arresting, they were probably annoying people a lot more important than me. Nice coincidence though, and happy to help.