DDos syn attack

Chris Wedgwood cw at f00f.org
Mon Dec 30 18:53:10 UTC 2002


On Mon, Dec 30, 2002 at 08:09:17AM -0800, Randy Bush wrote:

> actually, a bunch of research now shows that low ttls on A RRs (that
> are not the A RRs of NS RRs) has little effect.

maybe this could help find the attacking nwtwork?  assuming people are
using local DNS servers?

under attack you could sporadically 'lie' about the result... and log
to whom you lied to... all the time looking for changes in the DDoS
target

a fair amount work perhaps...


  --cw



More information about the NANOG mailing list