i had ddos attack
i used wireshark to analyzes packets on entery point (ethernet interface) i found packets incoming on:
mac protocol=800 (ip)
src-address=(diffirent ips from the world for each packet)
src-port=(diffirent ports for each packet)
dst-address=(diffirent ips for each packet)
dst-port=(diffirent ports for each packet)
i have implemented a filter to drop all incoming traffic at my network's entry point (drop everything),
but the DDoS attack is still getting through
and i receiving UDP packets with different source and destination IP addresses for each packet,
then try to change mac address for entry interface (ethernet), and not worked ,
when you turn in interface the attack start without setup any thing.
note 1: there ars only (rx packet) without (tx packet) on entry point
note 2: my isp have (switch network) to the internet (there is no servers or routers or any thing just switches) after that the isp give us global ip (we can reatch to this ip from all internet) .
what's type this ddos ? and depens on what ?
if i have no config on entry point - no ip and nothing
only the mac-address and connection to isp
how is rx packet come without tx
i had wireshark sniff file when attacks on if needed