performance myth: DoS attacks

myth:
flooding DoS attacks (randomly spoof src, main attack type)
only affect large commercial sites, are long in duration
and at extremely high rates
data:
>12,000 attacks against >5,000 targets in 3 weeks
~20-60 attacks occuring at all times
80% of attacks last less than an hour, a few lasted 3 weeks
70% of attacks <1,000 pps, some over 600,000 pps
10-20% of attacks to home machines (cable, dsl, dialup)
5% of attacks target infrastructure (routers, dns servers)
(usenix 2001, david,colleen@caida, stefan,geoff@ucsd)