RE: DoS/DDoS Attack

["Alex R" <alex () deviousmeans net>]

> Correct me if I am wrong, but, I understand that the MAC address is
> left unchanged and can be used to identify the source.

The MAC address is only used on the local LAN in a way. When I send a packet
to my default gateway it strips the frame off and adds its own other frame
for the next network type. So let's say the network is like this:

Host A ---> Ethernet LAN ---> router A ---> Frame Relay ----> router B --->
Ethernet LAN ---> host B

If host A sends a packet to host B the destination MAC address is the MAC
address of router A for its Ethernet interface. When host B receives the
packet the source MAC address will be the one of router B's Ethernet
interface.