Here are the gory details from the first MOTD last Saturday:
The attacker is forging random source addresses on his packets, so there is no way to find his/her location. There is also no way to screen out those packets with a simple router filter.
This is probably the most deadly type of denial-of-service attack possible. There is no easy or quick way of dealing with it. If it continues into Saturday we will start working on kernel modifications to try to absorb the damage (since there's absolutely no way to avoid it). This however will not be an easy job and it could take days to get done (and get done right).
For those who are IP hackers, the problem is that we're being flooded with SYNs from random IP addresses on our smtp ports. We are getting on average 150 packets
^^^^ Can't access to this port be guarded against by a filtering router which is configured to accept *only* a number of trusted MX hosts ? That is the target itself *never* permits any incoming traffic to smtp port *not* in the list of trusted MX hosts, which does buffering for the target ? Info on such MX hosts be hidden from secured way of DNS setup so attacker will not learn about the MX hosts easily. In case on MX host get flooded, there will be at least one backup host to take over to prevent a total D.O.S.
Since then the packet streams have hit almost all the ports for news, www, telnet, etc.
DCF
-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ M.C Wong Email: mcw@hpato.aus.hp.com Australian Telecom Operation Voice: +61 3 9210 5568 Hewlett-Packard Australia Ltd Fax: +61 3 9210 5550 P.O. Box 221, Blackburn 3130, Australia