Prevention will require tighter security measures throughout the Internet and cooperation among service providers. In a DDoS attack, the hacker breaks into insecure networks across the Internet, hijacks their systems, and uses them to flood the target site's communications bandwidth with bogus packets, overloading the target's servers, connections, and routers. If your site is the target, the first line of defense against such attacks is having the surge capability available in redundant connections, routers, and servers as well as multiple geographic locations to handle the onslaught, while you can work with your service provider to identify originating IP addresses and block the attacks. A technique called ingress and egress filtering lets ISPs control traffic flow at their networks' points of entry and exit and lets them eliminate packets with forged ip addresses, which are frequently used in these attacks. IT managers can also use the antispoofing capabilities of their routers to block forged IP addresses.
Prevention is another story.
Most of the victim sites already had tight security infrastructures. The hijacked sites did not. Click to see how a DDoS attack works. ZDNet and ZDNet logo are registered trademarks of ZD Inc. Content originally published in Ziff Davis Media publications is the copyrighted property of Ziff Davis Media. Ziff Davis Media.