Re: Why bandwidth consuming ddos attack using only udp or icmp?

[razigarbie () gmail com]

Does the traffic come from the same IP, is it spoofed?

The attacker(s) can SYN flood your server, and fill up the queue which will result in the service being unaccessable.

try to run: netstat -a -f inet
if you see A LOT of connections with the state "SYN_RECEIVED" it means that you have a lot of halfopen connection 
(beeing under attack).

Google for "prevent SYN flood" and you'll get a decent amount of hits.
Im not aware of a real "remedy" for this kind of attack in IPv4, however if you analyze the data you could discover a 
pattern and block it.

//RG