13 Oct
2004
13 Oct
'04
12:54 p.m.
How many people have seen "forged" spoofed IP addresses being used for DOS attacks lately?
syn-flood protection, and random TCP ISS, are now common enough that spoofed-source isn't effective for TCP flows. if you want to bring down somebody's web server then blackhats really do have to use real addresses. however, if you just want to make their web server unreachable, then you can either overload their DNS infrastructure or just congest their upstreams, and you don't need to use real addresses for that. i've never seen a dns attack that didn't have 50% or more packets coming from spoofed sources, though due to loose-mode uRPF, most spoofed sources in the last year or so have been from addresses for which a route exists. -- Paul Vixie