The Problem

• Attackers gain control of thousands of millions of hosts

  • Worm or virus infection
  • Bot nets

• Hosts send forged packets

  • IP source = forgery (random or victim)
  • IP destination = victim

• Forged packets go to victims

  • DNS request, TCP SYN, etc.

• Responses go to random places or other victims

  • DNS response, TCP ACK/RST, ICMP, etc.