SCO DOS attack verified

By Matt Whipp

Posted on 15 Dec 2003 at 11:31

Despite doubts that the denial of service attack on SCO's web-facing servers was genuine, new analysis reveals the attack was very much the real McCoy.

Researchers at CAIDA, the Cooperative Association for Internet Data Analysis, showed that the attacks on SCO's Web and FTP servers registered more than 50,000 packets per second at their peak, on Thursday morning of last week.

SCO later removed those servers from the Internet for a period, while its ISP filtered out traffic directed at them until they were put back online. However the UCSD Network Telescope picked up nearly 3 million response packets from SCO's servers, indicating they had to deal with some 700 million packets that constituted the SYN flood denial of service attack that SCO described itself as suffering.

This sort of load would have easily eaten up 20Mbits/sec of bandwidth both upstream and downstream, according to the researchers.

However, the reports agrees with critics that there is much that could have been done to protect the network from such attacks, such as implementing load balancers or proxies, and using SYN cookies.

SCO's web presence is now back up and running.