Security Incidents: Re: DoS attack... what to do?

[Jose Nazario <jose () monkey org>]

On Tue, 4 Jan 2005, Bernie Cosell wrote:

> How do you do this?  If the packets coming in have forged source-IP
> addresses, how do you trace them backwards?
backtrace via the input and output intreface IDs from the devices the
traffic traverses. if you have well formed characteristic (ie SYN packets
destined to a particular dest and dport) you can trace it that way. follow
it back as far as you can go and, if it crosses operational boundaries,
get some cooperation (in the case of very large events).

cisco does this, arbor does this, etc ...

________
jose nazario, ph.d.                     jose () monkey org
http://monkey.org/~jose/                http://infosecdaily.net/