Making their already-difficult job particularly intractable is the nature of such attacks. When network administrators see an unexpected deluge of traffic that threatens to swamp a Net connection, their first instinct is to stave off the flood and protect their customer's Web site. Keeping detailed records is a second priority. Even if administrators have some time to track the attack while it's happening, log files can be of little help. The broadside may not be able to be traced back beyond the remote computers the attacker is using as smurf originators, and other DoS tools forge their originating Internet address.
Exact numbers are difficult to come by.
At first, Global Crossing thought the network congestion was accidental. By that time, Hannan and the six other people in his company's conference room had already filtered out all the type of network traffic generated by smurf tools. At this time we decided to start logging things to get information now that we've got the situation stabilized. That seems to be common. Paul Vixie, a senior vice president for Internet services at Metromedia Fiber Network and Above.net, said some of his customers were attacked last week but have chosen not to go public.