Silicon Investor (SI) -- The First Internet Community

STOCKTALK

We've detected that you're using an ad content blocking browser plug-in or feature. Ads provide a critical source of revenue to the continued operation of Silicon Investor. We ask that you disable ad blocking while on Silicon Investor in the best interests of our community. If you are not using an ad blocker but are still receiving this message, make sure your browser's tracking protection is set to the 'standard' level.

Technology Stocks : Intel Corporation (INTC) -- Ignore unavailable to you. Want to Upgrade?

To: Tony Viola who wrote (98629)	2/9/2000 6:19:00 PM
From: Steve Lee	Read Replies (1) \| Respond to of 186894

I don't think there is anything a web site can do to protect itself from this kind of attack. Let's hope either the virus software people can identify the culprit program and issue an appropriate signature file or that the FBI/ISP's can detect the originators. It will be interesting to find out who is the root of this. If the traffic generator is clever, it will make the DNS queries some time well in advance of the attack, in order to avoid detection by tracing the DNS queries (which will have to use the genuine source addresses). If that is the case, then the best defence is to have a standby IP address ready and update the DNS entries after an attack. There will still be a lag though, as caching DNS servers and clients catch up with the new information. There is also a dependency on how long the server being attacked attempts to establish a connection, and what the performance hit of doing so is. I have read today that only Unix webservers are affected, but I don't quite understand how, unless they have been specifically targetted. I think it would be just as easy to target any kind of server.