So what do you propose doing if you're the target of a DDOS attack? Is there a good way to block traffic from attacking machines, while allowing traffic from legitimate machines, and preventing your network from being overwhelmed? Seems to me that if there were tools available to automatically identify attackers and shut them down (or better yet, simply shut down the attacking process) then an attacked network could recover from an attack as soon as it fights back, rather than simply waiting for the attacking machines to get bored and go away (or relying on the aparently incompetant sysadmins of those machines to fix themselves.)

In your analogy about being broken into, strikebacks are not the equivalent of chasing down the intruder and shooting them in the back. They are the more like shooting back while you're being shot at. Remember - this is about machines that are ACTIVELY attacking your network.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/134/17705#17705