[AusNOG] census issues tonight

[Mark Delany]

> Mark,
> If your point is that if an attacker can flood a server with traffic, the
> DOS will succeed, then we agree.

There are plenty of other resources to exhaust besides traffic
capacity, but ok.

> The point is to ensure that your attacker has an upper limit to resources
> available to them on the server. This is much harder to achieve with HTTPS,
> where you can't successfully create a session with a spoofed IP.

True. But bots don't need to spoof IPs. Nor recipients of IMG
tags. What makes you think the so-called DOS was based on spoofed IPs
anyway? I don't think I made any mention of it.

Point being, excepting the very largest destinations, it's not that
hard to acquire more bot capacity than your target's server capacity.


Mark.