If I&#x27;m not mistaken, the above implies accepting a TCP connection (3-way handshake) and a request from the attacker; then you look up the contents of the user-agent header and decide to stop replying based on its contents.<p>This will get you nothing in a typical DDoS scenario, but thanks for sharing as it may come handy for other situations.