Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thank you for your insight. A bogus IP - one that no one is listening on - would also not ACK a RST, right?

Doing a little googling this process seems to detect an attack (from a valid ip) that has been programmed to ignore RST - presumably because some intermediate ISPs (like tier1 borders) will detect a DDOS and forge a RST to attempt to mitigate them. Much like the firewall configs that circulated to defeat sandvine RST throttling of bittorrent.



A bogus host will obviously not respond to the RST but the last router-hop that receives the RST will (per RFC/protocol specs). The response is destination unreachable via ICMP. The ICMP unreachable packet is cheap (non-persistent) and requires no up-keep from the last hop to the bogus host. Most importantly, the ICMP unreachable packet requires no upkeep from the filtering node in EC2.

Regards


thanks much!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: