> We most frequently are the zombie/reflector participants
> in an attack that originates outside our network, to a
> target outside our network. As many as 8,000 hosts on
> our network are reflecting SYN floods in the current
> attacks.I finally found a paper on this type of attack.
You might also try:
"An Analysis of Using Reflectors for Distributed Denial-of-Service
Attacks," V. Paxson, Computer Communication Review 31(3), July 2001.
An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks
http://www.icir.org/vern/papers/reflectors.CCR.01.ps.gz
http://www.icir.org/vern/papers/reflectors.CCR.01.pdf
- Vern