I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me .
what are the relations between PPS (packets per seconds) and MBPS and can a huge number of pps like 500k/second leads to a ddos if even packets are getting dropped by the firewall ?
can ddos like syn/udp flood get fully mitigated only by iptables and can iptables handles any kind of ddos regarding it's strength and speed , also can iptables installed on the same server that is being attacked handles a very huge number of pps and drop them without any problems or affect on the performance ?
for the syn flood most of ppl recommend using syn cookies as a perfect solution to mitigate from the syn floods but unfortunately trying it didn't help , why ? does syn cookies have a limits or a something need to be tweaked on the server like the file discriptor ?
does upgrading for the network card on the server from 100mbit to 1gbps can help in more mitigation for the ddos attack or it will have no effect ?
NOTE : i mean in this case only upgrading the network interface but network speed still the same
- does the connection speed of the attacker like an attack from a server of 100mbps can send more number of packets per seconds or make more bandwidth than a normal connection with 10mbps ? in other words can a single server with 1GBPS connection take a a whole server down like a ddosing from a big botnet that have around 100k infected computers online with home connections ?