Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I was wondering if there are any DDoS defences where a (any) router will block all packets (for any period of time) from the MAC address of its attacker. If so, under what circumstances would this occur?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

If you know the MAC address of the attacker then surely you can just amble(ish) over to their computer and pull the network cable ? – Iain Jun 2 '13 at 19:17

Blocking by IP address is not generally used as a DDoS defence, as typically the network is already being loaded by this point, so blocking or dropping packets here offers little value.

In reality, the closer to the attackers you can mitigate the DDoS the more protection you can give, which is why Prolexic, Akamai and similar can offer effective mitigation services.

Blocking by MAC address, as @Iain pointed out, would be even less useful, as if you know their MAC address then they should be on the same network as you:-)

Have a look at this question over on Security Stack Exchange, along with our other questions tagged DDoS.

share|improve this answer
Thank you, but I need to know if this specific defence exists anywhere in the wild or if it's just a figment of my imagination. I haven't been able to find much on this specific topic. Thank you for your patience. – user176232 Jun 2 '13 at 20:30
@user176232, you are missing the point. Mac addresses to not cross a router. So there is no way this could be useful. – Zoredache Jun 2 '13 at 21:20

MAC addresses do not cross routers. Each time a router accepts an IP packet the lower layer is stripped (e.g Ethernet Frame). Mac addresses only apply to your local network.

If you are being DDoS on your local network, then login to your switch and disable the ports, or walk over to the computers and shut them down.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.