> One issue with reflective DDoS attacks is that traditional IP Traceback
> protocols usually only send the itrace messages either to the destination
> IP or along with the packet, which means that the reflectors, not
> the victim, get the itrace messages about the path(s) to the actual
> attacker. The topic came up in that class I took about perhaps sending
> the itrace messages to both the source and destination IPs, which
> would send itrace messages to the victim in reflective DDoS (since
> the spoofed source IP is the victim's along the path from the attacker
> to the reflector), but could also lead to increased traffic depending
> on implementation. I am not sure if this idea is being researched
> at the moment.
See my paper:
An Analysis of Using Reflectors for Distributed Denial-of-Service
Attacks, V. Paxson, Computer Communication Review 31(3), July 2001.
http://www.icir.org/vern/papers/reflectors.CCR.01/index.html
- Vern
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
Received on Mar 01 2002
Intro
