It sounds more like connection flooding to me. TCP SYN flooding would also work, although modern IP stacks should cope reasonably well with that if syncookies

It sounds more like connection flooding to me. TCP SYN flooding would also work, although modern IP stacks should cope reasonably well with that if syncookies are used. That said ... considering these are Macs, they probably have mDNS open to IPv6 link-local traffic. It might make more sense to flood the offending machine with valid, unicasted mDNS packets. I don't know how well the Apple mDNS daemon copes with high traffic volume, but in my experience Avahi (on an Atom-powered netbook, admittedly) can regularly use over 50% CPU on a wireless network with an oversized local subnet. Hypothetically, deliberately flooding an OS X system with complex but valid mDNS announcements could have interesting results... I should probably point out that Windows systems tend to be protected from this. Firstly, iTunes or Bonjour must be installed separately. Secondly, Windows Firewall tends to kick in with its "Public" profile, blocking inbound traffic by default. Thirdly, Windows machines tend to use mDNS over IPv4 multicast instead of IPv6 unless an auto-configured external address exists. This further reduces the traffic seen, although this last point is no protection from deliberate floods.