Effective ways to deal with DDoS attacks?

Mon May 6 23:15:25 UTC 2002

On Wed, 1 May 2002, Pete Kruckenberg wrote:

> We experience a lot of types of attacks
> ("education/research network"  = "easy hacker target").
> With DDoS incidents, it seems we are more often an
> unknowing/unwilling participant than the target, partly
> due to owning big chunks of IP address space.
> 
> We most frequently are the zombie/reflector participants
> in an attack that originates outside our network, to a
> target outside our network. As many as 8,000 hosts on
> our network are reflecting SYN floods in the current
> attacks.

I finally found a paper on this type of attack.  
http://grc.com/files/drdos.pdf and
http://grc.com/dos/grcdos.htm describe the attack and a few
possible defenses, though they are about as ineffective as
most other DDoS defenses.

Pete.