Okay I know this might sound silly or dumb, but I would like to know (if anyone knows) if it would be illegal to reroute DDoS traffic to fbi.gov...
I just thought it might be a good idea if you wanted to get your DDoS traffic investigated and I cannot think of a better way than this.
And by reroute I mean setup PF to reroute traffic that has been found to be DDoS and just forward it along to fbi.gov
Please let me know your thoughts, I'm being serious...
Thanks!
Help! My house is on fire! Lets burn down the fire station to get their attention!
Doing as you propose is unethical, potentially illegal and technically pointless.
Redirecting your DDoS traffic to another site makes you as complicit in the attack as the people attacking you. You do not like dealing with the mess that such an attack causes; why do you think that the sysadmin at any other site will like it more. How would you feel if someone decided you were more deserving of high traffic than they were? You'd think they were a cock, wouldn't you? Well that's you.
As I've already mentioned, you'd be just as guilty of directing a DDoS. While you're not generating the traffic, you are directing it. This is exactly the same as most botnets. The people controlling them aren't generating the traffic themselves; they're just directing it to one place. If it's illegal for them to do it, then it's just as illegal for you to do it.
Thirdly, one of the main problems with a DDoS is using all available bandwidth to your server. If you are redirecting traffic on your firewall, the traffic has already travelled over your transit connect, potentially maxing it out. You then want to send it back over the same link, saturating both directions.
The correct response for a DDos is to drop packets on the floor at your router if you're not saturating your transit. If you are, work with your transit provider to block the traffic before it reaches your link.
Incredibly poor idea. pf is not magic - all that setting it to forward DDoS traffic to the FBI will accomplish is make your machine attempt to perform a haphazard DoS against the FBI's web server.
If you change your DNS to point elsewhere, you site will seem to go down, so the DDoS will be successful. If you're willing to do this, just find an unallocated IP block, and point it to there. If you know who's doing it, you could point it at them, but it's questionably legal.
I wonder if any services let you set your DNS to resolve to 127.0.0.1, so all the bots DoS themselves...
Edit:
I just remembered about teh Blue Frog DDoS a couple of years back, they pointed their DNS to the guys hosting their blog, and took out all of their servers because of it. There was a massive backlash against them by the community, and I think their host was threatening legal action, but Blue Frog claimed not to have known they were under DDoS at the time.
Dude, since when is the Internet in the jurisdiction of FBI? They don't even have jurisdiction outside US, so will they be supposed to deal with a DDoS coming, for example, from Russia or China? Your question is... well, wow, just wow.
Let me get this straight. You've got a small time enemy, and your solution is to make another, much bigger enemy who isn't amused by stuff like this. Your little DDoS issue is gonna be the least of your problems. They are very serious people. You understand this, right?
Silly and dumb and illegal. Wait, that doesn't even quite capture it, does it?
Seriously, don't do this. If you want their help, go to http://www.ic3.gov/ and file a complaint. If you still want to get an idea of their reaction to your plan, contact your local FBI office and ask them. Who knows, maybe they'll say, "hey, that sounds good." But i'm betting not.
So not only do you feel that not enough bandwidth has been wasted by attacking you with denial of service. But you feel the need to send these packets through all the pipes between you and the FBI's network as well?
Think of all the people who are using these connections and do the only right thing. Drop the packages!
