Why are Denial of Service Attacks Hard to Defend?
Typical security systems tend to guard individual sites. Unfortunately, DoS / DDoS attacks cannot be defended at a site. This is because traffic congestion resulting from the attack has already occurred upstream from the victim, and legitimate customers, therefore, cannot get through. Thus, in a sense, it is too late for the victim to act. Defending a potential victim from denial of service attacks requires cooperation from upstream infrastructure. With the present-day Internet, it is relatively easy for attackers to “spoof” packet source addresses. It is, therefore, to tell precisely where the attack traffic originates. This makes it difficult to defend against attacks.
