distributed attack, high or not

Thu Jan 31 15:45:52 UTC 2002

"Joseph T. Klein" wrote:

> I saw what appears to be a distributed attack against a single IP
> address that reached nearly 500Mbs. I was thinking that this is
> high. Are people seeing any random attacks of this magnitude?
> --
> Joseph T. Klein
> jtk at titania.net

We have seen attacks of this magnitude on a rise.  Most of the attacks
however haven't been spoofed.   Spoofing is not really needed when
generating an attack of this size from possibly thousands of machines,
especially when targeting only a single IP.  The ability to  track such
a large attack with so many sources is fairly slim.  When seeing so many
random sources I wouldn't immediately assume it's spoofed.

--
Tom Sands
Chief Network Engineer
RackSpace Managed Hosting
tsands at rackspace.com
(210)892-4000