<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 8/17/19 3:16 PM, Damian Menscher
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABSP1Odz3fCotcNGDkNEuz=MW5JZLLCcxJzfAOOe=6uvq0HZ+A@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">On Fri, Aug 16, 2019 at 3:05 PM Jim Shankland
<<a href="mailto:nanog@shankland.org"
moz-do-not-send="true">nanog@shankland.org</a>> wrote:</div>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
I'm seeing slow-motion (a few per second, per IP/port pair)
syn flood <br>
attacks ostensibly originating from 3 NL-based IP blocks: <a
href="http://88.208.0.0/18" rel="noreferrer"
target="_blank" moz-do-not-send="true">88.208.0.0/18</a> <br>
, <a href="http://5.11.80.0/21" rel="noreferrer"
target="_blank" moz-do-not-send="true">5.11.80.0/21</a>,
and <a href="http://78.140.128.0/18" rel="noreferrer"
target="_blank" moz-do-not-send="true">78.140.128.0/18</a>
("ostensibly" because ... syn flood, <br>
and BCP 38 not yet fully adopted).<br>
<br>
Is anybody else seeing the same thing? Any thoughts on
what's going on? <br>
Or should I just be ignoring this and getting on with the
weekend?<br>
</blockquote>
<div><br>
</div>
<div>This appears to be a TCP amplification attack. Similar
to UDP amplification (DNS, NTP, etc) you can get some
amplification by sending a SYN packet with a spoofed source,
and watching your victims receive multiple SYN-ACK retries.
It's a fairly weak form of attack (as the amplification
factor is small), but if the victim's gear is vulnerable to
high packet rates it may be effective.<br>
<br>
</div>
</div>
</div>
</blockquote>
<p>That thought crossed my mind, but it seems to me that the weak
amplification factor, plus the broadly distributed set of forged
source addresses (within the blocks cited above), would make the
attack ineffective -- the whole point of DDoS being to focus a
broadly distributed set of (illegitimately obtained) source
resources on a narrow set of destination targets. Attacking 2 /18
blocks plus a /21 block in parallel with a weak-amplification
attack doesn't look like a successful DDoS strategy to me.<br>
</p>
<p>Jim</p>
<blockquote type="cite"
cite="mid:CABSP1Odz3fCotcNGDkNEuz=MW5JZLLCcxJzfAOOe=6uvq0HZ+A@mail.gmail.com">
<div dir="ltr">
<div class="gmail_quote">
<div>The victim (or law enforcement) could identify the true
source of the attack by asking transit providers to check
their netflow to see where it enters their networks.<br>
<br>
</div>
<div>Damian</div>
</div>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>