Pushback is a mechanism for defending against distributed denial-of-service (DDoS) attacks.
DDoS attacks are treated as a congestion-control problem,but because
most such congestion is caused by malicious hosts not obeying traditional end-to-end congestion control,the problem must be handled by the routers.
Functionality is added to each router to detect and preferentially drop packets that probably belong to an attack.
Upstream routers are also notiﬁed to drop such packets (hence the term Pushback) in order that the router’s resources be used to route legitimate
trafﬁc.In this paper we present an architecture for Pushback, it implementation under FreeBSD, and suggestions for how such a system can be implemented in core routers.