A Distributed Denial of Service attack has just occurred using reflectors. What are the implications in terms of tracing the attack back?

Question

Options

• Aa successful Traceback to the slave is not possible as by definition, a reflector DDoS attack spoofs
• Ba successful Traceback is possible as some form of reflector attacks require legitimate (non-spoofed)
• Ca successful Traceback to the reflector is possible and an examination of the reflector machine's logs
• Dreflector machines replace slaves in the attack, further complicating any Traceback effort

• A
  8% (4)
• B
  71% (36)
• C
  18% (9)
• D
  4% (2)

Explanation

Option B is correct because not all reflector DDoS attacks rely on IP spoofing - in certain variants, the slave machines send packets to the reflectors using legitimate, non-spoofed source addresses, which means those packets can be logged by the reflector and used to trace the attack back to the originating slave.

Why the distractors are wrong:

• A is too absolute. Claiming reflector attacks "by definition" always spoof ignores the variants where non-spoofed traffic is used - making traceback possible.
• C is misleading. While the reflector is easy to identify (it's sending traffic to the victim), its logs typically record the victim's IP as the source (the spoofed address), not the actual slave's IP - so logs alone don't reveal the true attacker.
• D overstates the complication. Reflectors do add an extra hop, but saying they "replace slaves" misstates the architecture and ignores that some attack types remain traceable.

Memory tip: Think "SOME roads have no disguise" - the key word in B is some. Not every reflector attack uses spoofing, and that exception is exactly what makes traceback possible. If you see an absolute claim like "never" or "by definition always," it's usually a distractor.

No community discussion yet for this question.