{"id":1789,"date":"2026-06-29T09:46:16","date_gmt":"2026-06-29T07:46:16","guid":{"rendered":"https:\/\/misot.pl\/?p=1789"},"modified":"2026-06-29T09:48:32","modified_gmt":"2026-06-29T07:48:32","slug":"ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki","status":"publish","type":"post","link":"https:\/\/misot.pl\/en\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/","title":{"rendered":"DDoS that feeds on silence....or why you don't have to pay a ransom in \u017babka bonds"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>You receive a\u00a0threatening email: <em>We've detected an issue with\u00a0your network. If you pay xxxx PLN in\u00a0bills from\u00a0\u017babka, we will add your network for\u00a0immediate anti-DDoS defense.<\/em> This is how the history of problems of many ISPs begins. A small extortion, but more and more operators are struggling with\u00a0this type of situation. This type of attack already has a name <em>Carpet attack<\/em> and\u00a0is directed in\u00a0subsequent Polish ISPs.&nbsp;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">EPIX as a traffic exchange node should, in\u00a0its assumptions, focus on\u00a0a reliable and\u00a0fast exchange of traffic in the L2 layer \u2013 ensure the transmission of packets between participants and\u00a0provide routing information in\u00a0OpenPeering. However, we cannot remain passive towards what is happening, which is why we systematically approach the\u00a0problem solving of our participants. In addition to building a scrubbing center, we try to educate the community \u2013 and\u00a0this article is part of it: it is a compilation of knowledge about what an attack is, an incentive to\u00a0take action and sample solutions. Actually: proposals for actions that will make life difficult for attackers.<\/p>\n\n\n\n<h2 id=\"h-opis-ataku\" class=\"wp-block-heading\"><strong>Description of the attack<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We are dealing with\u00a0a family attack <em>reflection\/amplification<\/em>, based entirely on the\u00a0very behavior of the TCP protocol \u2013 without using any vulnerability or error in the\u00a0software. The attacker does not direct traffic directly at the\u00a0victim; instead, he uses hundreds or thousands of legally operating web servers as unaware <em>fenders<\/em> (headlights), which also act as traffic multipliers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The starting point is the source address spoofing. The attacker sends TCP\/SYN packets, in\u00a0which he substitutes the victim's IP address as the sender's address, and the addresses of servers supporting HTTP and\u00a0HTTPS (ports 80 and\u00a0443) as the destination address. From the point of view of such a server, this looks like the most ordinary attempt to establish a connection: according to the specification, it sends the SYN\/ACK packet back, starting tripartite reconciliation (<em>Handshake<\/em>),<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And\u00a0this is where the crux of the problem comes in. The victim never initiated this connection, so even if the SYN\/ACK reaches\u00a0a working host, their TCP stack will not find a matching entry in\u00a0the array. It is worth noting, however, that\u00a0<em>naked<\/em> tCP stack (Linux, Windows) in\u00a0this situation by default <em>conforms<\/em> the RST package and\u00a0it is this RST that would interrupt the entire mechanism. So why does the attack work?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The answer lies in the\u00a0reality of carrier networks, to\u00a0which this attack is tailored. First, a single host is rarely the victim; the target is usually entire, large address classes, including ranges not used or allocated, but not occupied by any active device. SYN\/ACK packages then go to\u00a0<em>Black Holes<\/em>: there is no one to reject them, there is no one to respond with RST. From the perspective of the reflector-server, it looks identical to a packet lost on the network, so, exactly as the protocol dictates, it resumes transmission. And\u00a0again. And\u00a0again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Secondly, even where real hosts are hidden at the victim's address, NAT and edge devices are common in carrier networks, which unexpected, unsuitable for\u00a0any session simply\u00a0quietly drop traffic instead of sending RST. The effect is the same as with a black hole: no response that the reflector could interpret as the end of the connection, and\u00a0therefore retransmission after\u00a0retransmission.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each such retransmission is another packet landing in the victim's network. Depending\u00a0on the\u00a0configuration of the TCP stack on the multiplier server side, the cycle is usually repeated 6 to\u00a012 times before the connection is finally abandoned. A single contrived package sent by the attacker turns into\u00a0a dozen or so packages hitting the victim, sent not by the attacker himself, but by reliable WEBSITES scattered\u00a0throughout Poland. The result is millions of packets flooding the victim's link, coming from\u00a0addresses that are perfectly legal in\u00a0themselves.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the perfidy of this attack: there is no simple method of defense against it. Traffic cannot be simply filtered by the source address, because it flows from\u00a0real HTTP(S) servers \u2013 by blocking it, the victim would cut off their own legitimate web traffic. The blockade after the\u00a0port will not help either, because\u00a0it is the same port where normal communication with the parties takes place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A real solution remains a stateful firewall (<em>stateful firewall<\/em>) set on the\u00a0edge of the victim's network. It tracks the status of connections and\u00a0knows which ones were actually initiated from the\u00a0inside. When a SON\/ACK arrives that does not match\u00a0any entry in the call table, instead of silently rejecting it, he sends back the TCP\/RST packet. This RST is a clear signal to the reflector server that there is no connection and will not be \u2013 which immediately interrupts the retransmission chain and\u00a0eliminates the multiplication effect at\u00a0the source.<\/p>\n\n\n\n<h2 id=\"h-jak-sie-mozemy-bronic\" class=\"wp-block-heading\"><strong>How can we defend ourselves?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In fact, the only real defense is the hygiene of your own network. And\u00a0yes, just because\u00a0your network is not under attack at the moment does not mean that the zombie computers in your scope, which are part of the botnet, are not attacking other operators right now. This type of attack can only be cut at the source: by blocking the sending of spoofed packets. And\u00a0it is you, the operators, who have both the tools and the knowledge of\u00a0what should come out of\u00a0your networks and\u00a0what should not.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fact that you are not under attack at the moment \u2013 and\u00a0attacking others does not bother you \u2013 does not mean that\u00a0tomorrow your network will not become a target and you will have a problem. The saddest thing is that the relevant document has existed for a quarter of\u00a0a century. In\u00a0May 2000 \u2013 26 years ago \u2013 RFC 2827 (also known as BCP 38) was created, which directly describes how to configure carrier networks to prevent impersonation of source addresses. In\u00a0practice, it comes down to\u00a0filtering outgoing traffic (ingress filtering on the customer's edge) \u2013 often implemented by the uRPF mechanism \u2013 so that only packages with source addresses actually belonging to\u00a0it can come out of a given range. This is a bit of an analogy to\u00a0vaccination, by implementing solutions from\u00a0BCP 38 at\u00a0home, we strengthen the resilience of the entire Polish cyberspace.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With small networks, having\u00a0several or several dozen prefixes, the whole operation takes several minutes and does not noticeably affect the\u00a0load on modern routers. And\u00a0this is our common, social defense method \u2013 working before anyone is attacked. The more networks implement it, the fewer places spoofing can come from.&nbsp;<\/p>\n\n\n\n<h3 id=\"h-trwa-atak\" class=\"wp-block-heading\"><strong>Attack in progress?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It's not so rosy here anymore. As I mentioned earlier, a properly configured firewall or TCP stack \u2013 one that sends RST to an out-of-state SYN\/ACK instead of silently dropping it \u2013 should cope with the attack. However, I know from experience that\u00a0theory goes hand in hand with\u00a0practice. Most consumer ONTs and\u00a0routers do NATs to a user's network and\u00a0are usually vulnerable to this attack: silently dropping packets unrelated to any session they know, rather than responding with a reset. This is a real problem on\u00a0which the operator has limited influence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So what remains during\u00a0the attack? First, if you have a lot of unused prefixes, just don't advertise them; what's not in the routing tables won't get reflected traffic. Second, direct the addressing ranges you don't use to the TCP\/RST referral firewall rules, exactly as described in the\u00a0sections below. However, be careful here: a mass-generating RST device can itself become a spotlight for another attack, so such a rule must be limited to\u00a0its own, unoccupied ranges and\u00a0not respond to traffic from outside them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And\u00a0finally, NAT on\u00a0your devices \u2013 you are not completely defenseless here either.<\/p>\n\n\n\n<h2 id=\"h-ochrona-nieaktywnych-zakresow-w-sieci-bng-bras-pppoe\" class=\"wp-block-heading\"><strong>Protection of inactive ranges in the BNG (brass) \/PPPoE network<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Since the attack feeds on silence \u2013 the lack of\u00a0RST where the packet goes to an\u00a0unoccupied address \u2013 the most effective defense is to turn any such <em>black hole<\/em> in\u00a0a device that consciously responds with a reset to an unexpected SYN\/ACK. In the PPPoE terminated BNG\/BRAS operator network, this can be done extremely elegantly, because the infrastructure itself provides the ready signal <em>address is active<\/em>: presence of a host route\/32.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The mechanism is based on the longest-prefix match rule. When the client's PPPoE session gets up, BNG installs a route \/32 for his address indicating the subscriber's interface (<em>framed route<\/em>). When the session rains \u2013 this route \/32 disappears. For the entire address pool of subscribers (e.g. \/20), we maintain <strong>the route covering<\/strong> \u2013 less detailed \u2013 directing traffic to the\u00a0firewall or a dedicated RST referral server. The distribution of traffic then happens automatically, without any additional logic:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>active address \u2013 a more detailed route \/32 with\u00a0BNG wins, the traffic goes to the\u00a0customer;<\/li>\n\n\n\n<li>address inactive \u2013 none \/32, so the covering route wins and the traffic lands on the reset sending device.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">So instead of directing the unused address space in null-route (a classic black hole that is silent and\u00a0thus drives the retransmissions of the reflector), we direct it to where every out-of-state SON\/ACK will meet with RST. And\u00a0because attacks of this type target large, rarely planted ranges, we hit exactly the\u00a0middle of the vector.<\/p>\n\n\n\n<h3 id=\"h-dedykowany-serwer-responder\" class=\"wp-block-heading\"><strong>Dedicated server-responder<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Role <em>RST-Responder<\/em> it can perform the edge firewall itself, but you can also put a machine dedicated to\u00a0this task next to\u00a0it \u2013 a kind of controlled <em>victims to\u00a0attack<\/em>, which takes over\u00a0all the traffic to\u00a0dead addresses. In\u00a0both variants, the key <strong>mask<\/strong>, not a metric: it is the less detailed prefix (e.g. \/20 versus \/32 of the active customer) that makes the responder by definition only get traffic to unoccupied addresses. The metric determines something else \u2013 competition between routes of the same length \u2013 so it is useful only for\u00a0redundancy (firewall as the basic route, server as a backup announcing the same prefix with a worse metric), and\u00a0not for\u00a0the selection itself <em>active versus inactive.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, there is a trap here that can destroy the whole idea. <em>Bare<\/em> system stack responds with RST to\u00a0unexpected SYN\/ACK <strong>only if the packet is addressed to\u00a0its own local IP address<\/strong>. In\u00a0this scenario, the SYN\/ACK flies to the client's address from the pool \/20 \u2013 an address that the server does not have. If the route simply indicates the server as next-hop, the machine will see the foreign destination address and\u00a0either try to forward the packet further or reject it as <em>martian<\/em> \u2013 under\u00a0no circumstances will it generate a reset. In other words: placed <em>barefoot<\/em> the server will just be another black hole.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In order for the responder to actually reset, it must <em>embrace<\/em> the entire pool as your own. In\u00a0practice, this means configuring the entire range as local on\u00a0this machine and a default-deny policy with\u00a0an explicit reset \u2013 on\u00a0Linux REJECT -reject-with tcp-reset (iptables\/nftables) \u2013 or using a dedicated responder or tarpit listening on the entire prefix and\u00a0generating RST. This is a conscious configuration,\u00a0not <em>Adverse effect <\/em>bare stack, and it is this distinction that determines whether the solution works or just gives the impression.<\/p>\n\n\n\n<h3 id=\"h-wymiarowanie-i-zakres-ochrony\" class=\"wp-block-heading\"><strong>Dimensioning and\u00a0scope of protection<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Two things are worth having in the\u00a0back of your head before such a construction goes into\u00a0production. First, the responder becomes <strong>the outlet of the attack<\/strong>: all reflected traffic to\u00a0inactive addresses is focused on\u00a0one node. RSTs themselves are tiny and\u00a0stateless, so generating them is cheap \u2013 but receiving millions of packets per\u00a0second is already a matter of PPS performance, interrupt handling, and network adapter, not bandwidth. An ordinary server has its ceiling here; in a serious attack, you either have to reach for generating RST in the kernel (XDP\/eBPF, in front of the entire network stack), or take into account that the responder will also fail under load \u2013 and\u00a0then silence will occur again instead of a reset. Therefore, this victim to\u00a0attack must be dimensioned under real volume,\u00a0not staked <em>as\u00a0a\u00a0spare.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, this technique specifically closes the gap <em>blackhole on\u00a0unoccupied ranges<\/em>and\u00a0not the whole problem. A subscriber with\u00a0an active session has its route \/32, so the reflected SYN\/ACK will normally be delivered to it by BNG \u2013 and the multiplication has to be handled by its CPE, which, as we have established before, usually silently drops traffic behind NAT. The protection of inactive ranges and the defense of active customers are therefore two complementary elements, not substitutes.<\/p>\n\n\n\n<h2 id=\"h-przyklady-konfiguracji\" class=\"wp-block-heading\"><strong>Configuration examples<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We return here to the\u00a0announced defense <em>NAT on\u00a0your devices<\/em>. The following examples relate precisely to <strong>nAT performing operator equipment<\/strong> (edge BNG, CGNAT, router\/firewall translating subscriber traffic) \u2013 not an abstract firewall on the\u00a0side. This is important, because\u00a0NAT is based on the conntrack \/ session table anyway; so since the device is already tracking sessions for translation, it can be induced to respond to a packet outside this table with a reset instead of a silent drop. The NAT RST itself does not send \u2013 it is done by the state module on the same device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the whole defensive thesis comes down to\u00a0one thing: the NAT device has an\u00a0out-of-state SYN\/ACK <em>reply with RST<\/em>, and\u00a0not quietly sprinkle it. Below are specific projects on\u00a0three popular platforms plus a variant with\u00a0a dedicated server-responder. It is worth noting right away that\u00a0platforms differ fundamentally here \u2013 from a mechanism directly created for\u00a0this task (Juniper) to one that targets something else and\u00a0requires a workaround (Cisco).<\/p>\n\n\n\n<h3 id=\"h-juniper-srx\" class=\"wp-block-heading\"><strong>Juniper SRX<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The cleanest case \u2013 Junos has a dedicated option that sends an RST in\u00a0response to a TCP segment with\u00a0any flag other than a pure SON if it does not match\u00a0any existing session. Exactly the reflector scenario:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set security flow tcp-session tcp-rst<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The decision is made on the\u00a0path <em>first path<\/em> flow support: the incoming SYN\/ACK does not create a session (because it is not a SYN package), so instead of a silent drop, the device sends the RST to the sender \u2013 i.e. to the reflector server. By default, the function is disabled, it must be enabled explicitly.<\/p>\n\n\n\n<h3 id=\"h-mikrotik-routeros\" class=\"wp-block-heading\"><strong>MikroTik (RouterOS)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Here, the implementation is based on a filter rule rejecting motion in an invalid state with\u00a0an explicit reset. The hook concerns the classification of the state: with default loose-tcp-tracking =yes the wandering SON\/ACK can be marked as new instead of invalid and\u00a0bypass the rule. That's why we're tightening call tracking first:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/ip firewall connection tracking set loose-tcp-tracking=no\n\/ip firewall filter add chain=forward protocol=tcp connection-state=invalid \\\n    action=reject reject-with=tcp-reset<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After\u00a0this change, the TCP packet not matching\u00a0any entry in the conntrack enters the invalid state, and the rule sends back the tcp-reset, giving the reflector an unambiguous signal of the end of the connection.<\/p>\n\n\n\n<h3 id=\"h-cisco-asr-ios-xe-zbfw\" class=\"wp-block-heading\"><strong>Cisco ASR (IOS-XE \/ ZBFW)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is a case where you need to be careful. Feature <em>TCP Reset Segment Control <\/em>w\u00a0parameter-map type inspect <em>nie<\/em> is used to\u00a0reset packets outside the session \u2013 sends RST only at the\u00a0time of <strong>deleting (expiration) sessions<\/strong> half-open, half-close or idle, after the appropriate timer has expired:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>parameter-map type inspect pmap-name\n tcp synwait-time 10\n tcp half-open reset on\n tcp idle reset on<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The default behavior of ZBFW for a packet that does not fit\u00a0any session is silent <em>policy drop<\/em> (class-default), without RST. In other words: on\u00a0ASR, the above configuration will speed up the cleaning of half-open sessions and\u00a0send them a reset after the timer, but will not respond with a reset <em>charged immediately<\/em> to the\u00a0wandering SON\/ACK from the\u00a0spotlight \u2013 and that's what this attack is all about. On\u00a0this platform, a more reliable solution is to direct the unoccupied ranges to\u00a0a dedicated server-responder (below), and the ZBFW configuration itself for stray SYN\/ACK should be verified in the lab on\u00a0a specific version of IOS-XE.<\/p>\n\n\n\n<h3 id=\"h-dedykowany-serwer-responder-linux\" class=\"wp-block-heading\"><strong>Dedicated server-responder (Linux)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The most predictable variant, independent\u00a0of the\u00a0specificity of the vendor. The machine must first <em>embrace <\/em>the entire pool as a local one \u2013 otherwise, as discussed above, it will itself become a black hole. On\u00a0Linux, the local route (AnyIP) is used for\u00a0this, which makes the kernel treat the entire range as its own addresses:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ip route add local 198.51.100.0\/24 dev lo<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then the default-deny policy with\u00a0an explicit reset for traffic outside the existing (initiated from\u00a0the inside) sessions. Since this host never initiates calls to\u00a0these addresses by itself, each incoming SYN\/ACK is by definition unexpected and\u00a0gets reset:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># nftables\ntable inet responder {\n    chain input {\n        type filter hook input priority 0; policy drop;\n        ct state established,related accept\n        ct state invalid tcp reset\n        tcp flags &amp; (syn|ack) == syn|ack ct state new reject with tcp reset\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With a very large volume, even this has a stack performance ceiling \u2013 then RST generation moves to the kernel before the proper network stack (XDP\/eBPF), allowing you to respond with a much higher PPS.<\/p>\n\n\n\n<h2 id=\"h-firewall-z-zabki-czy-warto-placic-okup\" class=\"wp-block-heading\"><strong>Firewall from\u00a0\u017babka \u2013 is it worth paying the ransom?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let's go back to the threatening email we started with for\u00a0a moment. Its authors are counting on you to pay \u2013 because you think that you have no choice and\u00a0that the defense is out of your reach. Meanwhile, this whole attack feeds on one thing: silence. The silence of the server-reflector, which does not get\u00a0RST and\u00a0retransmits. The silence of a black hole on an unoccupied range. The silence of CPE, which quietly drops behind NAT. And\u00a0\u2013 at\u00a0the very source \u2013 the silence of networks that allow spoofed packets to leave, because\u00a0no one has configured filtering.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each of\u00a0these silences can be broken, and\u00a0tools have been in existence for years: a stateful firewall referencing TCP\/RST, conscious management of unused prefixes, a responder on\u00a0blind spots, and\u00a0above all \u2013 outbound traffic filtering according to RFC 2827. None of\u00a0these solutions require paying a ransom in\u00a0bonds. It requires something that the criminal will not sell you: a dozen or so minutes of work and\u00a0a little community responsibility.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And\u00a0that's the point. Defending against this attack is not a\u00a0solo game. Your properly configured network protects not only you \u2013 it protects everyone else, because one less source of spoofing means less ammunition for attackers throughout Poland. It also works the\u00a0other way around: you use the\u00a0hygiene of other operators. The more of us, the tighter the attacker.<\/p>\n\n\n\n<h2 id=\"h-co-mozesz-zrobic-juz-dzis\" class=\"wp-block-heading\"><strong>What can you do today?<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Implement outbound filtering (RFC 2827 \/ BCP 38).<\/strong> On\u00a0the edge of your own network, make sure that only packages with source addresses that actually belong to\u00a0you can leave each range \u2013 simply by using the uRPF mechanism. This is the most important item on\u00a0this list.<\/li>\n\n\n\n<li><strong>Don't post prefixes you don't use.<\/strong> What is not in the routing tables, it will not attract reflected traffic. A more nasty solution is to prepare a quick path to disable broadcasting of unused prefixes in the\u00a0event of detecting an attack \u2013 this action will burn some of the attacker's resources.&nbsp;<\/li>\n\n\n\n<li><strong>Configure the state firewall\/NAT to send back TCP\/RST<\/strong> on\u00a0packets outside the session board, instead of silently dropping them \u2013 following the\u00a0examples for your platform above.<\/li>\n\n\n\n<li><strong>Refer unoccupied ranges to RST referral responder<\/strong>, remembering to limit it only to\u00a0your own addresses and\u00a0not become a spotlight for someone else.<\/li>\n\n\n\n<li><strong>Close ports 80 and\u00a0443 on externally available ONTs\/CPE subscribers<\/strong> \u2013 Your network will not be an attack multiplier.&nbsp;<\/li>\n\n\n\n<li><strong>See if you're part of the problem yourself.<\/strong> Verify that there is no traffic coming from\u00a0your network with spoofed source addresses \u2013 even if no one is attacking you today.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Don't wait for your network to become a target. The best time to\u00a0implement these changes was 26 years ago, when RFC 2827 was created. The second best is now.&nbsp;<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Have questions, need setup support, or want to talk about\u00a0protecting your network? <a id=\"mailto:\">Talk to us!<\/a> \u2013 as an EPIX community, we are here to make life difficult for attackers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Related posts <\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-isportal wp-block-embed-isportal\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"wp-embedded-content\" data-secret=\"RWIc4GoaVL\"><a>Thinking about\u00a0cybersecurity, don't forget about\u00a0tSEC<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"&quot;When thinking about\u00a0cybersecurity, do not forget about tSEC&quot; \u2014 ISPortal\" src=\"https:\/\/isportal.pl\/myslac-o-cyberbezpieczenstwie-nie-zapominaj-o-tsec\/embed\/#?secret=9C2SCSr0NV#?secret=RWIc4GoaVL\" data-secret=\"RWIc4GoaVL\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n<\/div><\/figure>","protected":false},"excerpt":{"rendered":"<p>You receive a\u00a0threatening email: We have detected a problem on\u00a0your network. If you pay xxxx PLN in\u00a0bills from\u00a0\u017babka, we will add your network for\u00a0immediate anti-DDoS defense. This is how the history of problems of many ISPs begins. A small extortion, but more and more operators are struggling with\u00a0this type of situation. This type of attack is already called Carpet Attack and\u00a0is directed at\u00a0other Polish ISPs. <a class=\"more-link\">...<span class=\"screen-reader-text\">  DDoS that feeds on silence....or why you don't have to pay a ransom in \u017babka bonds<\/span><\/a><\/p>","protected":false},"author":1,"featured_media":1790,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1789","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dla-klientow"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.8 (Yoast SEO v27.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w bonach z \u017babki - Mi\u015aOT - Wsparcie dla ma\u0142ych i \u015brednich operator\u00f3w telekomunikacyjnych<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/misot.pl\/en\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w bonach z \u017babki\" \/>\n<meta property=\"og:description\" content=\"Dostajesz maila z\u00a0pogr\u00f3\u017ckami: Wykryli\u015bmy problem w\u00a0Twojej sieci. Je\u015bli zap\u0142acisz xxxx z\u0142 w\u00a0bonach z\u00a0\u017babki, dodamy Twoj\u0105 sie\u0107 do\u00a0natychmiastowej obrony anty-DDoS. Tak zaczyna si\u0119 historia problem\u00f3w wielu ISP. Niby niewielkie wymuszenie, ale coraz wi\u0119cej operator\u00f3w boryka si\u0119 z\u00a0tego typu sytuacjami. Tego typu atak ma ju\u017c swoj\u0105 nazw\u0119 Atak dywanowy i\u00a0jest kierowany w\u00a0kolejnych polskich ISP.&nbsp; EPIX jako w\u0119ze\u0142 ... DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w\u00a0bonach z\u00a0\u017babki\" \/>\n<meta property=\"og:url\" content=\"https:\/\/misot.pl\/en\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/\" \/>\n<meta property=\"og:site_name\" content=\"Mi\u015aOT - Wsparcie dla ma\u0142ych i \u015brednich operator\u00f3w telekomunikacyjnych\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-29T07:46:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-29T07:48:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/misot.pl\/wp-content\/uploads\/2026\/06\/markusspiske-neourban-1808082.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"5760\" \/>\n\t<meta property=\"og:image:height\" content=\"3840\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"mis-admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"mis-admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/\"},\"author\":{\"name\":\"mis-admin\",\"@id\":\"https:\\\/\\\/misot.pl\\\/#\\\/schema\\\/person\\\/1f013dbd6dc0c1b6aff012a58574633a\"},\"headline\":\"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w\u00a0bonach z\u00a0\u017babki\",\"datePublished\":\"2026-06-29T07:46:16+00:00\",\"dateModified\":\"2026-06-29T07:48:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/\"},\"wordCount\":3333,\"image\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/misot.pl\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/markusspiske-neourban-1808082.jpg\",\"articleSection\":[\"Dla klient\u00f3w\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/\",\"url\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/\",\"name\":\"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w bonach z \u017babki - Mi\u015aOT - Wsparcie dla ma\u0142ych i \u015brednich operator\u00f3w telekomunikacyjnych\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/misot.pl\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/markusspiske-neourban-1808082.jpg\",\"datePublished\":\"2026-06-29T07:46:16+00:00\",\"dateModified\":\"2026-06-29T07:48:32+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/#\\\/schema\\\/person\\\/1f013dbd6dc0c1b6aff012a58574633a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#primaryimage\",\"url\":\"https:\\\/\\\/misot.pl\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/markusspiske-neourban-1808082.jpg\",\"contentUrl\":\"https:\\\/\\\/misot.pl\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/markusspiske-neourban-1808082.jpg\",\"width\":5760,\"height\":3840},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/misot.pl\\\/2026\\\/06\\\/29\\\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Strona g\u0142\u00f3wna\",\"item\":\"https:\\\/\\\/misot.pl\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w\u00a0bonach z\u00a0\u017babki\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/misot.pl\\\/#website\",\"url\":\"https:\\\/\\\/misot.pl\\\/\",\"name\":\"Mi\u015aOT - Wsparcie dla ma\u0142ych i \u015brednich operator\u00f3w telekomunikacyjnych\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/misot.pl\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/misot.pl\\\/#\\\/schema\\\/person\\\/1f013dbd6dc0c1b6aff012a58574633a\",\"name\":\"mis-admin\",\"sameAs\":[\"https:\\\/\\\/misot.dream-county.pl\"],\"url\":\"https:\\\/\\\/misot.pl\\\/en\\\/author\\\/mis-admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"DDoS that feeds on silence....or why you do not have to pay a ransom in \u017babka bonds - Mi\u015aOT - Support for small and medium-sized telecommunications operators","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/misot.pl\/en\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/","og_locale":"en_US","og_type":"article","og_title":"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w bonach z \u017babki","og_description":"Dostajesz maila z\u00a0pogr\u00f3\u017ckami: Wykryli\u015bmy problem w\u00a0Twojej sieci. Je\u015bli zap\u0142acisz xxxx z\u0142 w\u00a0bonach z\u00a0\u017babki, dodamy Twoj\u0105 sie\u0107 do\u00a0natychmiastowej obrony anty-DDoS. Tak zaczyna si\u0119 historia problem\u00f3w wielu ISP. Niby niewielkie wymuszenie, ale coraz wi\u0119cej operator\u00f3w boryka si\u0119 z\u00a0tego typu sytuacjami. Tego typu atak ma ju\u017c swoj\u0105 nazw\u0119 Atak dywanowy i\u00a0jest kierowany w\u00a0kolejnych polskich ISP.&nbsp; EPIX jako w\u0119ze\u0142 ... DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w\u00a0bonach z\u00a0\u017babki","og_url":"https:\/\/misot.pl\/en\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/","og_site_name":"Mi\u015aOT - Wsparcie dla ma\u0142ych i \u015brednich operator\u00f3w telekomunikacyjnych","article_published_time":"2026-06-29T07:46:16+00:00","article_modified_time":"2026-06-29T07:48:32+00:00","og_image":[{"width":5760,"height":3840,"url":"https:\/\/misot.pl\/wp-content\/uploads\/2026\/06\/markusspiske-neourban-1808082.jpg","type":"image\/jpeg"}],"author":"mis-admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"mis-admin","Est. reading time":"17 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#article","isPartOf":{"@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/"},"author":{"name":"mis-admin","@id":"https:\/\/misot.pl\/#\/schema\/person\/1f013dbd6dc0c1b6aff012a58574633a"},"headline":"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w\u00a0bonach z\u00a0\u017babki","datePublished":"2026-06-29T07:46:16+00:00","dateModified":"2026-06-29T07:48:32+00:00","mainEntityOfPage":{"@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/"},"wordCount":3333,"image":{"@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#primaryimage"},"thumbnailUrl":"https:\/\/misot.pl\/wp-content\/uploads\/2026\/06\/markusspiske-neourban-1808082.jpg","articleSection":["Dla klient\u00f3w"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/","url":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/","name":"DDoS that feeds on silence....or why you do not have to pay a ransom in \u017babka bonds - Mi\u015aOT - Support for small and medium-sized telecommunications operators","isPartOf":{"@id":"https:\/\/misot.pl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#primaryimage"},"image":{"@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#primaryimage"},"thumbnailUrl":"https:\/\/misot.pl\/wp-content\/uploads\/2026\/06\/markusspiske-neourban-1808082.jpg","datePublished":"2026-06-29T07:46:16+00:00","dateModified":"2026-06-29T07:48:32+00:00","author":{"@id":"https:\/\/misot.pl\/#\/schema\/person\/1f013dbd6dc0c1b6aff012a58574633a"},"breadcrumb":{"@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#primaryimage","url":"https:\/\/misot.pl\/wp-content\/uploads\/2026\/06\/markusspiske-neourban-1808082.jpg","contentUrl":"https:\/\/misot.pl\/wp-content\/uploads\/2026\/06\/markusspiske-neourban-1808082.jpg","width":5760,"height":3840},{"@type":"BreadcrumbList","@id":"https:\/\/misot.pl\/2026\/06\/29\/ddos-ktory-zywi-sie-cisza-czyli-dlaczego-nie-musisz-placic-okupu-w-bonach-z-zabki\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Strona g\u0142\u00f3wna","item":"https:\/\/misot.pl\/"},{"@type":"ListItem","position":2,"name":"DDoS, kt\u00f3ry \u017cywi si\u0119 cisz\u0105.\u2026czyli dlaczego nie musisz p\u0142aci\u0107 okupu w\u00a0bonach z\u00a0\u017babki"}]},{"@type":"WebSite","@id":"https:\/\/misot.pl\/#website","url":"https:\/\/misot.pl\/","name":"Mi\u015aOT - Support for small and medium-sized telecommunications operators","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/misot.pl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/misot.pl\/#\/schema\/person\/1f013dbd6dc0c1b6aff012a58574633a","name":"Mis-admin","sameAs":["https:\/\/misot.dream-county.pl"],"url":"https:\/\/misot.pl\/en\/author\/mis-admin\/"}]}},"_links":{"self":[{"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/posts\/1789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/comments?post=1789"}],"version-history":[{"count":4,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/posts\/1789\/revisions"}],"predecessor-version":[{"id":1795,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/posts\/1789\/revisions\/1795"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/media\/1790"}],"wp:attachment":[{"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/media?parent=1789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/categories?post=1789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/misot.pl\/en\/wp-json\/wp\/v2\/tags?post=1789"}],"curies":[{"name":"WordPress","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}