Validation
Backscatter not explained by port scanning
- 98% of backscatter packets don't cause response
Repeated experiment with independent monitor (3 /16's from Vern Paxson)
- Only captured TCP SYN/ACK backscatter
- 98% inclusion into larger dataset
Matched to actual attacks detected by Asta Networks on large backbone network