Re: [rtcweb] UDP transport problem

[cowwoc <[e-mail]>]

On 14/02/2014 9:42 AM, Cb B wrote:
> Right. The source port will be a function of the amp server such as 
> 53, 123, 19... all very common. The destination port is of the 
> spoofers choosing.
>
> But, as the us-cert advisory notes, there are several impacted 
> appilication ports. Well-known webrtc fixed ports would help for a 
> white list.
>
> Creating a blacklist of just 53, 123, 19 makes us still behind the 
> curve on whatever is next.
>

Which is why we will never be able to stop DDoS attacks:

 1. With dumb firewall rules that rely upon port numbers alone.
 2. Unless the destination address is able to communicate back to the
    source (or as close as possible to the source) that it does not wish
    to continue receiving (any) packets from it, and in so doing pushes
    the problem back as far as possible to the source.

Gili