Security Incidents: Re: DoS attack... what to do?

["Bernie Cosell" <bernie () fantasyfarm com>]

On 4 Jan 2005 at 16:44, Mark C wrote:

> 1) Netsky's 5556 is TCP, so I'd fire up netcat or something and see if 
> actual 3-way handshakes happen.  If yes, then it's much less likely that 
> it's someone out in the world spoof SYNflooding you.  If no, then I'd 
> treat this as a SYNflood and trace backwards through the ISP, you'll 
> probably find it's coming from far fewer sources than you think.
How do you do this?  If the packets coming in have forged source-IP 
addresses, how do you trace them backwards?

  /Bernie\

-- 
Bernie Cosell                     Fantasy Farm Fibers
mailto:bernie () fantasyfarm com     Pearisburg, VA
    -->  Too many people, too few sheep  <--