Re: DoS Attacks, Detecting the Source, and Service Providers

[H C <keydet89 () yahoo com>]

Hamid,
 
> Maybe a newbie question, but I was wondering if
> back-tracing packets to its
> source is a service provider requirement? I mean if
> one of my hosts is being
> attacked, for example a simple ICMP DoS attack, what
> could I do if the service provider doesn't
cooperate?

Requirement?  Not hardly.  If you're experiencing an
attack, you can (a) configure your own systems
(routers, f/ws) to protect against it, and (b) *ask*
your ISP to do the same.

> I was wondering if there are certain procedures to
> detect the source of attacks?

What attacks?  Things like ICMP DoS and even UDP-based
attacks like Slammer are relatively easy to
spoof...TCP-based attacks (except for things like SYN
flooding) are more difficult.  



__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com