2 ms·

Good points; however, 1) many victims are not running http3 and 2) there are ways of addressing the cases you mention, such as dropping unauthenticated TLS traf

Good points; however, 1) many victims are not running http3 and 2) there are ways of addressing the cases you mention, such as dropping unauthenticated TLS traffic, isolating any external-facing DNS and NTP servers (and probably with whitelisting/sandboxing/time-windowing), etc. (I'm also not a fan of abusing DNS for load balancing, but that is another discussion.) All of this can be done in hardware at line rate. And source address validation is going to help as well. I'd be interested in your ideas as to the best steps forward for improving the DDoS situation, if you have a reference.

karlgkk 2y ago
between 20%-60% of internet traffic today uses quic/http3 (udp). depends on many factors. so like... many victims, even the majority maybe, are using udp. and the solutions you suggested are either non-starters for various reasons, or already being done and considered table stakes
- deleted 2y ago
  [deleted]
- deleted 2y ago
  [deleted]
- musicale 2y ago
  40% to 80% solution would be very significant. If source address validation is already being done, shouldn't it block reflection attacks that depend on source address spoofing?