0

After studying networking for some time, I just realize that the Layer 3 and Layer 2 don't care about the content of the packets they forward. All they care is the header, and further processing of the payload is left to higher layers.

If my router's address is static and known, can people flood it with excessive amount of garbage packets? Even if my router has no port opened, theoretically I think it is still possible to sent packets with random port numbers to it -- the router will drop the packet as there is either forwarding rule or program to process the packets with such port number, but such action would still consume precious bandwidth.

If this ever happens, can I do anything about it? Placing a firewall before the router and ban an IP address does not prevent the bandwidth from being consumed -- the firewall just drops them before they reach the router. Not to mention that the attacker can always change the source IP address on the IP packet header for every packet he sends. It sounds so easy for anyone with equal or higher bandwidth than mine to disrupt my WAN connection.

3
  • Unfortunately, questions about networks you do not directly control are off-topic here. You should probably ask this question on Information Security. If you peer BGP with your ISP, there is RTBH that you may be able to set up, but we really cannot help you with what goes on outside of your own network.
    – Ron Maupin
    Oct 12 '20 at 12:23
  • It doesn't matter if your address is static or dynamic. If someone knows your current address, they can easily flood that connection with junk. Anyone with any sense will do so with spoofed traffic so you can't know where it's actually coming from.
    – Ricky
    Oct 12 '20 at 19:23
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 22:39
1

If my router's address is static and known, can people flood it with excessive amount of garbage packets?

All they need is the known IP address. Of course, your router drops all traffic that doesn't fit one of its policies/connections.

If this ever happens, can I do anything about it?

If it's a clear attack you can ask your ISP for help. Especially dropping the traffic at their perimeter solves your problem.

You can also file a complaint with the source IP's provider (check whois) or call the authorities if the source is in your country.

Since you've used the ddos tag: a distributed DoS attack is much harder to defend than simple DoS. You will need your ISP when the attack approaches or exceeds your capacities.

2
  • Assume that it is a simple DoS, and the attacker is in my country. What will prevent him from randomizing the source IP address for every packet he sends? The only one who knows his real IP address is his ISP, so unless they do check and drop his packets in the first place... I wonder.
    – Livy
    Oct 12 '20 at 11:01
  • 1
    Of course, the source IP address may be spoofed, but very often it's not - spoofed addresses don't cross most NAT routers. More often it's a bot, but shutting that down is a good deed as well.
    – Zac67
    Oct 12 '20 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.