Clickity click

Sure, it was easy enough to stop the SYN attack on Monday [1] by just turning off the IP (Internet Protocol) address under attack. But the owner of the sites on that IP address want to know which site was the one being attacked.

So, how do you determine which of fifty-plus sites was the victim of a SYN attack?

By giving each of the fifty-plus sites their own IP address and seeing which one gets SYN attacked, that's how.

Clickity clickity clickity clickity clickity

Apparently, not all the sites were abandoned alas …

Clickity clickity clickity clickity clickity

[1] /boston/2005/08/08.3

Gemini Mention this post

Contact the author