Ilmu Komputer & AI editorial
Open AccessOA2026
Spoofer or Spoofers? Estimating a Lower Bound on the Number of DRDoS Sources Using Anycast Honeypots
A novel anycast honeypot methodology reveals that at least 21.0% of DRDoS attacks originate from multiple network locations, challenging single-source attribution assumptions.
Bernhard Degen; Bas Palinckx; Mattijs Jonker; Roland van Rijswijk-Deij; Raffaele Sommese· 2026· DOI 10.48550/arXiv.2607.14832
The core problem
Distributed Reflection Denial-of-Service (DRDoS) attacks remain a significant threat to Internet infrastructure. These attacks leverage spoofed source IP addresses to direct amplified traffic toward victims, making traceback to true sources exceptionally difficult. Understanding attacker behavior and deployment patterns is crucial for designing effective defenses and attribution techniques. However, the distributed nature of spoofing—where attackers may use multiple networks to launch attacks—complicates efforts to quantify the number of involved networks. This paper addresses this gap by introducing a novel methodology to estimate a lower bound on the number of networks generating spoofed traffic. The authors leverage a global deployment of anycast amplification honeypots that attract requests from topologically nearby sources. By analyzing the set of honeypots receiving spoofed traffic and variations in observed Time-To-Live (TTL) values, they develop two estimators that account for natural path instability. The study analyzes 287 days of amplification attacks, providing empirical evidence that a substantial fraction of attacks originate from multiple network locations. The findi
Innovation
Analyzing 287 days of amplification attacks, the authors find that at least 21.0% of attacks originate from multiple network locations. This means that for more than one-fifth of the attacks, the spoofed traffic was observed from at least two distinct networks, as inferred by the honeypot set and TTL variation estimators. The results are consistent across different types of amplification attacks and various geographic regions. The authors also report the distribution of the estimated number of networks per attack, showing that some attacks involve dozens of networks. For instance, the honeypot set estimator indicates that a significant portion of attacks involve more than five networks. The TTL variation estimator corroborates these findings, with a strong correlation between the two methods. The paper provides detailed statistics, including the percentage of attacks classified as multi-network, the distribution of TTL variations, and the impact of path instability on the estimates. The authors note that their estimates are lower bounds; the true number of networks could be higher. They also discuss potential biases, such as the anycast routing potentially missing sources that are
Distributed Reflection Denial-of-Service (DRDoS) attacks remain a significant threat to Internet infrastructure. These attacks leverage spoofed source IP addresses to direct amplified traffic toward victims, making traceback to true sources exceptionally difficult. Understanding attacker behavior and deployment patterns is crucial for designing effective defenses and attribution techniques. However, the distributed nature of spoofing—where attackers may use multiple networks to launch attacks—complicates efforts to quantify the number of involved networks. This paper addresses this gap by introducing a novel methodology to estimate a lower bound on the number of networks generating spoofed traffic. The authors leverage a global deployment of anycast amplification honeypots that attract requests from topologically nearby sources. By analyzing the set of honeypots receiving spoofed traffic and variations in observed Time-To-Live (TTL) values, they develop two estimators that account for natural path instability. The study analyzes 287 days of amplification attacks, providing empirical evidence that a substantial fraction of attacks originate from multiple network locations. The findings have implications for coordinated defense strategies and future attribution research.
The authors employ a global anycast honeypot infrastructure designed to attract amplification attack traffic. Anycast allows multiple physical honeypots to share the same IP address, so spoofed requests are routed to the topologically nearest honeypot. This setup enables the observation of spoofed traffic from diverse sources. To estimate the number of networks involved, the authors propose two estimators:
Why it matters
The finding that at least 21.0% of DRDoS attacks originate from multiple network locations has significant implications for defense and attribution. It suggests that attackers frequently distribute spoofing activity across networks, possibly to evade detection or to increase attack volume. This challenges the assumption that a single network is responsible for an attack, which is often made in attribution efforts. The authors argue that combating spoofing requires coordinated and distributed defenses. For example, network operators should implement source address validation (e.g., BCP 38) not only at the edge but also in transit networks, as spoofed traffic may traverse multiple autonomous systems. The results also inform the design of future attribution techniques: instead of focusing on a single source, attribution systems must consider the possibility of multiple sources and aggregate evidence from various vantage points. The paper acknowledges limitations, such as the lower-bound nature of the estimates and the reliance on anycast honeypots, which may not capture all spoofing sources. Future work could extend the methodology to other types of attacks and integrate additional data sources. Overall, the study provides a robust framework for estimating the number of spoofing sources and highlights the need for a paradigm shift in how we understand and mitigate DRDoS attacks.
Who should read this
CS practitioners and researchers
Opening member content…