We present a measurement study analyzing DDoS attacks from multiple data sources, relying on both direct measure- ments of low-level information, and more traditional indi- rect measurements using backscatter analysis. Understand- ing the nature of DDoS attacks is critically important to the development of effective counter measures to this press- ing problem. While much of the communitys current un- derstanding of DDoS attacks result from indirect measure- ments, our analysis suggests that such studies do not give a comprehensive view of DDoS attacks witnessed in todays Internet. Specifically, our results suggest little use of address spoofing by attackers, which imply that such attacks will be invisible to indirect backscatter measurement techniques. Further, at the detailed packet-level characterization (e.g., attack destination ports), there are significant diferences between direct and indirect measurements.
