IW: Tools Stunt DoS Attacks

[Lars Gaarden]

Andrew Alston wrote:

> Basically, people who claim to be able to stop DDOS/trace DDOS/etc etc I
> believe are playing on the public, making money out of a situation that
> unfortunatly has no end in site, due to the fuckups made in the IP
> protocol by the department of defense when they released the RFC.

Spoofed source-addresses can be (and often are) blocked at the
access ISP. RFC 2267, Ingress filtering.

DDOS trojans on ISDN/xDSL/Cable home user boxes will have to use
their real (or at least same subnet) source addresses on datagrams,
or run the risk of having the traffic dropped silently at the first
router.


There is also work being done on tagging and tracing datagrams.
http://www.cs.washington.edu/homes/savage/traceback.html


This won't stop DDOS attacks, but it will make it a lot harder to
mount an attack without exposing many of the DDOS trojans
participating.

-- 
"I'm rather jubilant now. What Judge Kaplan did was blow away every one
of these brittle and fragile rebuttals. He threw out fair use; he threw
out reverse engineering; he threw out linking."
- Jack Valenti, president of the Motion Picture Association of America.