On Fri, 02 Oct 2026 12:04:37 -0400, Paul Wouters wrote: >On Fri, 2 Oct 2026, Joe Abley wrote: >... > >> Imagine how much simpler DOS mitigation would be if UDP transport was rare. > >Not sure TCP or QUIC is that much easier to DOS mitigate? > >...
A connection-mandatory protocol like TCP is HUGELY easier to DDoS-mitigate than UDP. The TCP handshake proves the other side exists before your server does significant work. From a DNS-centric viewpoint: you get DNS-cookie-style anti-spoofing automatically. And you have already-widely-deployed TCP SYN cookies to push back onto the attacker the minimal state a spoofed SYN would impose on the server. The web people have been doing TCP and fighting DoS for 30 years. They know a couple of things. -John _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
