Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Okay I know this might sound silly or dumb, but I would like to know (if anyone knows) if it would be illegal to reroute DDoS traffic to

I just thought it might be a good idea if you wanted to get your DDoS traffic investigated and I cannot think of a better way than this.

And by reroute I mean setup PF to reroute traffic that has been found to be DDoS and just forward it along to

Please let me know your thoughts, I'm being serious...


share|improve this question

closed as off topic by Zypher May 19 '11 at 16:58

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Help! My house is on fire! Lets burn down the fire station to get their attention!

share|improve this answer
+1 for succinctly giving the right message in a humorous way. – Knox Aug 8 '09 at 13:17

Doing as you propose is unethical, potentially illegal and technically pointless.

Redirecting your DDoS traffic to another site makes you as complicit in the attack as the people attacking you. You do not like dealing with the mess that such an attack causes; why do you think that the sysadmin at any other site will like it more. How would you feel if someone decided you were more deserving of high traffic than they were? You'd think they were a cock, wouldn't you? Well that's you.

As I've already mentioned, you'd be just as guilty of directing a DDoS. While you're not generating the traffic, you are directing it. This is exactly the same as most botnets. The people controlling them aren't generating the traffic themselves; they're just directing it to one place. If it's illegal for them to do it, then it's just as illegal for you to do it.

Thirdly, one of the main problems with a DDoS is using all available bandwidth to your server. If you are redirecting traffic on your firewall, the traffic has already travelled over your transit connect, potentially maxing it out. You then want to send it back over the same link, saturating both directions.

The correct response for a DDos is to drop packets on the floor at your router if you're not saturating your transit. If you are, work with your transit provider to block the traffic before it reaches your link.

share|improve this answer
Even better, ask your ISP to filter/block the traffic at their level. Chances are their equipment will scale better for the task. Plus I'm sure they will just as interested in keeping the extra load off their network. – David Aug 9 '09 at 4:17
That's what I said. "work with your transit provider to block the traffic before it reaches your link" – David Pashley Aug 9 '09 at 8:01

Incredibly poor idea. pf is not magic - all that setting it to forward DDoS traffic to the FBI will accomplish is make your machine attempt to perform a haphazard DoS against the FBI's web server.

share|improve this answer
okay lets change this up to reduce the technical nature of it, if you were to change the DNS to point to (yes they are DDoSing the DNS). I was attempting to give an example... – kernelPanic Aug 8 '09 at 6:44
Redirecting the attack by means of DNS is still a bad idea. – duskwuff Aug 8 '09 at 18:59

If you change your DNS to point elsewhere, you site will seem to go down, so the DDoS will be successful. If you're willing to do this, just find an unallocated IP block, and point it to there. If you know who's doing it, you could point it at them, but it's questionably legal.

I wonder if any services let you set your DNS to resolve to, so all the bots DoS themselves...


I just remembered about teh Blue Frog DDoS a couple of years back, they pointed their DNS to the guys hosting their blog, and took out all of their servers because of it. There was a massive backlash against them by the community, and I think their host was threatening legal action, but Blue Frog claimed not to have known they were under DDoS at the time.

share|improve this answer

Dude, since when is the Internet in the jurisdiction of FBI? They don't even have jurisdiction outside US, so will they be supposed to deal with a DDoS coming, for example, from Russia or China? Your question is... well, wow, just wow.

share|improve this answer

Let me get this straight. You've got a small time enemy, and your solution is to make another, much bigger enemy who isn't amused by stuff like this. Your little DDoS issue is gonna be the least of your problems. They are very serious people. You understand this, right?

Silly and dumb and illegal. Wait, that doesn't even quite capture it, does it?

Seriously, don't do this. If you want their help, go to and file a complaint. If you still want to get an idea of their reaction to your plan, contact your local FBI office and ask them. Who knows, maybe they'll say, "hey, that sounds good." But i'm betting not.

share|improve this answer

So not only do you feel that not enough bandwidth has been wasted by attacking you with denial of service. But you feel the need to send these packets through all the pipes between you and the FBI's network as well?

Think of all the people who are using these connections and do the only right thing. Drop the packages!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.