Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?

share|improve this question
    
Sie question - if the forged IP was private range, your ISP should have filtered them, you should have filtered them. The forge must / should be public (i.e. a non-private IP). –  TomTom May 31 '12 at 18:19
    
@TomTom, absolutely. But it seems to just be completely random. –  Rob May 31 '12 at 18:28

2 Answers 2

up vote 12 down vote accepted

No is the effective answer. It is not the absolute answer since a theoretical condition exists where one could successively ask each upstream connection to the next to look at their complete dump of traffic and tell you where the packet came from. In a sustained attack with a lot of volume from a single source, one might be able to do this with live data and filtering over a period of time with the help of each successive upstream system owner.

But for all realistic and likely scenarios, you'll never find the source of some single spoofed packet, or even many of them.

share|improve this answer

IP packets don't contain any information about the path they traversed (with the exception of the TTL header, but that wouldn't tell you what it was initially).

So there is no practical way to do this. You could contact your upstream provider, and they might be able to tell roughly where it came from if they have large network. But unless it is a serious recurring problem you are out of luck.

If you are interested in a more academic side, or what a internet provider might do go read this article.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.