Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
&gt; Internet service providers should never allow IP spoofing to be performed on their network. IP spoofing is the true root cause of the issue. See the infamous BCP38.<p>I don&#x27;t see how it is at all reasonable to shift blame from a protocol that assumes the world can be trusted to the untraceable goal of &quot;every single network in the entire world should only generate trusted data: then the problem would be solved&quot;.<p>&gt; Internet providers should internally collect netflow protocol samples. The netflow is needed to identify the true source of the attack. With netflow it&#x27;s trivial to answer questions like: &quot;Which of my customers sent 6.4Mpps of traffic to port 1900?&quot;. Due to privacy concerns we recommend collecting netflow samples with largest possible sampling value: 1 in 64k packets. This will be sufficient to track DDoS attacks while preserving decent privacy of single customer connections.<p>OMFG. Do you want deanonymization attacks? Because this is how you get deanonymization attacks :&#x2F;. The right form of solution here is not to encourage ISPs to log even more of our traffic (a practice I wish were illegal), but to try to kill off UPNP through every form of leverage possible (even if it breaks things).<p>I&#x27;d say this is &quot;so disappointing&quot;, but I guess I shouldn&#x27;t expect much from the company that tried its damndest to argue that nothing of importance was leaked from Cloudbleed even when you could still recover Grindr requests complete with IP addresses that they had managed to leak well after they tried to claim that data had been scrubbed :&#x2F;.