<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div dir="ltr"><br>
</div>
<div dir="ltr">
<blockquote type="cite">On Jan 28, 2020, at 07:39, Mike Hammett <nanog@ics-il.net> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">If someone is being spoofed, they aren't receiving the spoofed packets. How are they supposed to collect anything on the attack?</div>
</blockquote>
<br>
<div>OP stated that *his own network* was being packeted with a TCP reflection/amplification attack. </div>
<div><br>
</div>
<div>This means that if he's collecting flow telemetry from his edge routers, he sees the details of the resultant attack traffic, & since that attack traffic isn't spoofed from his perspective, he can ask the networks on which the abused reflectors/amplifiers
reside, & their peers/transits he can infer, to perform traceback, & work it network-by-network.</div>
<div><br>
</div>
<div>And even if his network weren't on the receiving end of a reflection/amplification attack, OP could still see backscatter, as Jared indicated. </div>
<div><br>
</div>
<div>Instrumenting one's network in order to achieve visibility into one's traffic is quite beneficial. It's easy & inexpensive to get started with open-source tools. </div>
<div><br>
</div>
<div>
<p class="p1" style="margin: 0px; font-stretch: normal; font-size: 17.4px; line-height: normal; color: rgb(69, 69, 69); -webkit-text-size-adjust: auto;">
<span class="s1" style="font-size: 17.41pt;">--------------------------------------------</span></p>
<p class="p1" style="margin: 0px; font-stretch: normal; font-size: 17.4px; line-height: normal; color: rgb(69, 69, 69); -webkit-text-size-adjust: auto;">
<span class="s1" style="font-size: 17.41pt;">Roland Dobbins <roland.dobbins@netscout.com></span></p>
</div>
<div><br>
</div>
<div><br>
</div>
</body>
</html>