ID:181046
 
I've become the target of a DDoS attacker. I wish I knew who was behind it...my router logs show a bunch of different IPs attempting to reach port 58061 yesterday when I was trying to host a BYOND game. Pretty consistent with a DDoS attack on my Internet connection, and it was lagging the server to hell.

If anyone can find out who is doing this so that their ISP can be informed of their criminal activity, that would be great.

Here's what I found in the router's logs, and keep in mind these are JUST the attempted connections to port 58061:
[LAN access from remote] from 89.103.19.31:49994 to 192.168.1.2:58061 Wednesday, Oct 12,2011 23:43:12
[LAN access from remote] from 86.126.234.101:2130 to 192.168.1.2:58061 Wednesday, Oct 12,2011 19:22:40
[LAN access from remote] from 217.72.93.242:32951 to 192.168.1.2:58061 Wednesday, Oct 12,2011 19:07:53
[LAN access from remote] from 71.1.111.25:64519 to 192.168.1.2:58061 Wednesday, Oct 12,2011 19:06:19
[LAN access from remote] from 89.123.55.66:14221 to 192.168.1.2:58061 Wednesday, Oct 12,2011 18:45:39
[LAN access from remote] from 114.76.140.62:54256 to 192.168.1.2:58061 Wednesday, Oct 12,2011 18:38:13
[LAN access from remote] from 175.138.85.30:1034 to 192.168.1.2:58061 Wednesday, Oct 12,2011 18:32:23
[LAN access from remote] from 68.144.68.77:50584 to 192.168.1.2:58061 Wednesday, Oct 12,2011 18:00:50
[LAN access from remote] from 89.123.55.66:14017 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:58:49
[LAN access from remote] from 71.1.111.25:63449 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:56:15
[LAN access from remote] from 190.179.55.170:12748 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:51:12
[LAN access from remote] from 89.151.206.149:58719 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:46:13
[LAN access from remote] from 86.164.65.181:53097 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:44:17
[LAN access from remote] from 75.82.136.206:58963 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:41:37
[LAN access from remote] from 24.239.237.179:57972 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:31:52
[LAN access from remote] from 89.143.147.207:57835 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:30:37
[LAN access from remote] from 175.138.85.30:4329 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:29:22
[LAN access from remote] from 217.72.93.242:49410 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:21:33
[LAN access from remote] from 114.76.140.62:53962 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:18:34
[LAN access from remote] from 188.26.81.32:55592 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:15:03
[LAN access from remote] from 70.124.90.26:63607 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:05:52
[LAN access from remote] from 174.29.17.46:51499 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:04:29
[LAN access from remote] from 186.205.179.177:65443 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:03:24
[LAN access from remote] from 190.196.15.69:4397 to 192.168.1.2:58061 Wednesday, Oct 12,2011 17:01:02
[LAN access from remote] from 95.245.213.87:2202 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:51:09
[LAN access from remote] from 68.148.188.153:57731 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:43:57
[LAN access from remote] from 76.120.98.184:51388 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:41:32
[LAN access from remote] from 184.100.246.184:25088 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:40:39
[LAN access from remote] from 68.144.68.77:50417 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:40:31
[LAN access from remote] from 109.151.128.167:61900 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:39:22
[LAN access from remote] from 80.236.28.217:3141 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:37:47
[LAN access from remote] from 190.179.55.170:12554 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:35:01
[LAN access from remote] from 89.123.55.66:13766 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:34:29
[LAN access from remote] from 80.56.8.245:56288 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:33:15
[LAN access from remote] from 108.88.41.239:59211 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:32:21
[LAN access from remote] from 108.88.41.239:59204 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:32:16
[LAN access from remote] from 89.143.147.207:57434 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:27:37
[LAN access from remote] from 89.151.206.149:58184 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:25:37
[LAN access from remote] from 86.164.65.181:51821 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:23:35
[LAN access from remote] from 177.52.1.8:55275 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:23:26
[LAN access from remote] from 69.118.70.58:49754 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:21:27
[LAN access from remote] from 24.224.249.36:59863 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:21:02
[LAN access from remote] from 24.17.100.146:57567 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:18:27
[LAN access from remote] from 71.1.111.25:61872 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:17:11
[LAN access from remote] from 67.61.133.13:64516 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:12:59
[LAN access from remote] from 72.196.194.30:62789 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:11:35
[LAN access from remote] from 109.172.31.252:27664 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:09:06
[LAN access from remote] from 109.172.31.252:27663 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:09:02
[LAN access from remote] from 175.138.66.144:3978 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:08:55
[LAN access from remote] from 91.38.142.250:55777 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:08:46
[LAN access from remote] from 121.216.201.94:57668 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:07:25
[LAN access from remote] from 75.82.136.206:58123 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:06:53
[LAN access from remote] from 67.170.145.118:54056 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:06:42
[LAN access from remote] from 98.168.189.94:1287 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:06:26
[LAN access from remote] from 110.169.167.191:58206 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:05:49
[LAN access from remote] from 77.168.52.64:57182 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:02:52
[LAN access from remote] from 114.76.140.62:53698 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:02:31
[LAN access from remote] from 177.17.235.228:2262 to 192.168.1.2:58061 Wednesday, Oct 12,2011 16:01:15
[LAN access from remote] from 24.239.237.179:57368 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:59:45
[LAN access from remote] from 59.167.196.41:52558 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:59:11
[LAN access from remote] from 65.27.111.98:44957 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:59:00
[LAN access from remote] from 80.236.28.217:2419 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:57:04
[LAN access from remote] from 186.205.179.177:58877 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:56:48
[LAN access from remote] from 217.72.93.242:42958 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:56:09
[LAN access from remote] from 76.238.198.247:50818 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:55:55
[LAN access from remote] from 203.173.192.57:64412 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:55:32
[LAN access from remote] from 99.106.230.85:56301 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:55:25
[LAN access from remote] from 188.26.81.32:54746 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:54:30
[LAN access from remote] from 74.70.96.151:58671 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:54:00
[LAN access from remote] from 50.80.228.187:63324 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:53:14
[LAN access from remote] from 70.65.30.130:56864 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:51:47
[LAN access from remote] from 66.58.141.221:55612 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:50:46
[LAN access from remote] from 108.88.41.239:50610 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:47:37
[LAN access from remote] from 108.88.41.239:50589 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:47:34
[LAN access from remote] from 76.175.100.12:49528 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:47:24
[LAN access from remote] from 70.64.66.26:61212 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:47:21
[LAN access from remote] from 72.211.149.228:54870 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:47:18
[LAN access from remote] from 68.71.4.18:53349 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:39:07
[LAN access from remote] from 173.19.239.237:61173 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:38:17
[LAN access from remote] from 190.196.15.69:3787 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:37:37
[LAN access from remote] from 95.245.213.87:1536 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:37:03
[LAN access from remote] from 89.123.55.66:13270 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:36:09
[LAN access from remote] from 89.123.55.66:13256 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:36:06
[LAN access from remote] from 89.151.206.149:57800 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:35:51
[LAN access from remote] from 76.120.98.184:51125 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:35:29
[LAN access from remote] from 99.195.80.111:3681 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:35:18
[LAN access from remote] from 68.52.106.9:59751 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:32:46
[LAN access from remote] from 220.255.225.134:52582 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:31:30
[LAN access from remote] from 220.255.4.26:49386 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:31:21
[LAN access from remote] from 174.29.17.46:50286 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:31:07
[LAN access from remote] from 82.153.196.71:56686 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:30:33
[LAN access from remote] from 74.237.207.43:50600 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:30:20
[LAN access from remote] from 109.178.136.147:65144 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:30:00
[LAN access from remote] from 109.151.128.167:53187 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:29:55
[LAN access from remote] from 68.148.188.153:57193 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:29:04
[LAN access from remote] from 77.126.75.204:55845 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:29:00
[LAN access from remote] from 190.179.55.170:12331 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:27:54
[LAN access from remote] from 71.1.111.25:59564 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:27:47
[LAN access from remote] from 184.100.246.184:22574 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:25:27
[LAN access from remote] from 68.144.68.77:50298 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:25:25
[LAN access from remote] from 89.143.147.207:56498 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:25:11
[LAN access from remote] from 98.204.194.194:52825 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:24:53
[LAN access from remote] from 85.218.209.83:57364 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:24:29
[LAN access from remote] from 98.204.194.194:52560 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:22:50
[LAN access from remote] from 175.138.66.144:3651 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:22:36
[LAN access from remote] from 75.118.2.163:53866 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:20:17
[LAN access from remote] from 76.204.247.163:52855 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:19:21
[LAN access from remote] from 184.167.186.152:51965 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:19:03
[LAN access from remote] from 71.225.226.153:52344 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:14:17
[LAN access from remote] from 24.17.100.146:57384 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:14:03
[LAN access from remote] from 109.172.31.252:27380 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:13:03
[LAN access from remote] from 109.172.31.252:27379 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:12:59
[LAN access from remote] from 99.181.213.50:56970 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:12:50
[LAN access from remote] from 99.181.213.50:56967 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:12:46
[LAN access from remote] from 93.194.89.57:55942 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:11:49
[LAN access from remote] from 77.251.237.247:61075 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:10:25
[LAN access from remote] from 83.160.120.16:52683 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:10:18
[LAN access from remote] from 86.81.214.166:53218 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:10:13
[LAN access from remote] from 99.46.186.254:56146 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:08:57
[LAN access from remote] from 88.167.139.60:57112 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:08:55
[LAN access from remote] from 74.78.141.175:1728 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:08:53
[LAN access from remote] from 70.241.101.82:60493 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:08:05
[LAN access from remote] from 50.93.123.206:59289 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:07:50
[LAN access from remote] from 80.236.28.217:1455 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:06:59
[LAN access from remote] from 69.148.170.145:3849 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:06:50
[LAN access from remote] from 80.56.8.245:52301 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:05:50
[LAN access from remote] from 189.106.144.36:17929 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:05:17
[LAN access from remote] from 75.40.89.208:49884 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:04:37
[LAN access from remote] from 173.177.81.8:11042 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:03:47
[LAN access from remote] from 77.251.99.183:58048 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:03:05
[LAN access from remote] from 89.241.53.50:25782 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:02:54
[LAN access from remote] from 89.241.53.50:25742 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:02:50
[LAN access from remote] from 24.83.34.119:55888 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:01:48
[LAN access from remote] from 174.60.85.24:56475 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:01:36
[LAN access from remote] from 151.55.101.97:60260 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:01:03
[LAN access from remote] from 50.98.154.122:63962 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:00:25
[LAN access from remote] from 68.57.241.48:52581 to 192.168.1.2:58061 Wednesday, Oct 12,2011 15:00:17
[LAN access from remote] from 38.108.140.114:53306 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:57:49
[LAN access from remote] from 24.224.249.36:58216 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:57:39
[LAN access from remote] from 67.199.164.101:61222 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:56:34
[LAN access from remote] from 200.101.113.152:53117 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:55:37
[LAN access from remote] from 93.56.17.1:53458 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:55:21
[LAN access from remote] from 86.52.34.58:60001 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:55:07
[LAN access from remote] from 79.116.181.10:57856 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:53:45
[LAN access from remote] from 67.61.133.13:20565 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:53:39
[LAN access from remote] from 86.164.65.181:63691 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:53:28
[LAN access from remote] from 189.34.44.136:3390 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:52:57
[LAN access from remote] from 69.171.123.74:55203 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:51:17
[LAN access from remote] from 174.62.231.219:55187 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:50:15
[LAN access from remote] from 69.250.216.226:53144 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:48:48
[LAN access from remote] from 67.163.84.41:2371 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:48:40
[LAN access from remote] from 69.118.70.58:49475 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:48:36
[LAN access from remote] from 188.25.243.218:52678 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:47:54
[LAN access from remote] from 76.122.63.116:61114 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:47:02
[LAN access from remote] from 83.38.217.74:26851 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:47:02
[LAN access from remote] from 76.122.63.116:61025 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:46:58
[LAN access from remote] from 24.3.245.59:1996 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:46:35
[LAN access from remote] from 77.168.52.64:56433 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:45:27
[LAN access from remote] from 124.120.169.11:3781 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:45:14
[LAN access from remote] from 124.120.169.11:3769 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:45:10
[LAN access from remote] from 121.216.201.94:51829 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:44:19
[LAN access from remote] from 99.106.230.85:55282 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:44:15
[LAN access from remote] from 177.52.1.8:50293 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:43:56
[LAN access from remote] from 2.136.191.122:4750 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:43:48
[LAN access from remote] from 98.122.55.214:55874 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:42:27
[LAN access from remote] from 110.169.167.191:57925 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:42:25
[LAN access from remote] from 83.5.147.42:60258 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:41:59
[LAN access from remote] from 98.168.189.94:4901 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:41:56
[LAN access from remote] from 71.82.69.164:58628 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:41:13
[LAN access from remote] from 68.151.16.79:62711 to 192.168.1.2:58061 Wednesday, Oct 12,2011 14:41:01
I don't believe there's a way to completely block DDoS. Firewall is supposed to block them efficiently without lagging computer.

Also, judging from logs, that's not sufficient to be DDoS. Are you sure people weren't simply trying to connect to your game?
Usually when you get real DDoS it's hundreds, thousands or more connections per second.
They're using proxy servers. That means you would need to contact the proxy and then ask them for their records. Even if you got that far then they may be using multiple proxies in which case you must contact the next one.

DDOS attacks like this are are infamous for their anonymity. Unless what you're doing it to is a big corporate or the government there is little chance of actually getting caught.

The only real way to stop it would be for you to limit your router so that a port can only be accessed once every half second for example. That would still make your players mad if they are rejected.
In response to Zaoshi
I was hosting on a different port. However, I went into my router's settings and realized that UPnP was on, and the UPnP port is 58061. So I turned off the UPnP function on the router.

At this point, I'm not really sure if it was a DDoS attack. I share the connection with my neighbor, and her grandkids were over that day, so it's possible those kids hopped on the Wi-Fi as well and were downloading things off peer-to-peer. I did go into the router's settings and increased the throughput to performance mode (54 > 150 mbps) from legacy (b-compatible) mode. Seems to have made a big difference in my connection speed.
In response to Ryuujin
That doesn't look like a DDoS attack because, as stated before, the attack(s) are usually a bunch of connections at the "same" time...meaning the same second/couple of seconds/minute(s)...

And about the whole "not getting caught" thing. It's actually very east to trace a DDoS attack, seeing as if it's not a bot-net the IP Addresses will not likely change. Meaning you have however long you want to trace it. Also, proxy servers aren't much help because if you contact your ISP about being DDoSed and give them proof (i.e. a bunch of the same IP's connecting every few seconds), they will contact the proxy and if it's based in a major country (USA, UK, Asia, etc) they have to give the proxied IP. However, if it's a bot-net...that's a whole different story because if it's a "good" one, the owner can change the IPs of their bots with a simple command.

My two cents.

EDIT: How to stop a DDoS attack? You could filter all ports and only allow X outbound port(s) for whatever you're doing. For example port 4444 can be allowed if you want to host on that port, or 80 if you want to host a basic HTTP service.
In response to Hi1
Hi1 wrote:
EDIT: How to stop a DDoS attack? You could filter all ports and only allow X outbound port(s) for whatever you're doing. For example port 4444 can be allowed if you want to host on that port, or 80 if you want to host a basic HTTP service.

But you still receive all the packets which overload your line. Therefore I think there's no way to defend from it completely.
ok imma make it easy for you

1. you can shut down all ports

pros << no one can get in which means no DDoS :D
cons << no more hosting :C

2. you can set up firewalls and routers and switchs

pros << slow packets can host
cons << people will disconnect be slow / lag can still get a DDoS

3. set up a IDS prob the best way to do it

pros << rarely any DDoS attack slows it down
cons << slows u down to


conclusion << U can't stop them unless u close everything you can only slow them down.