# US 12,603,916 B2 · Systems and methods for increased security using client address manipulation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,916 B2 - Document ID: US12603916B2 - Status: Granted - Kind: B2 - Application number: 18/629,065 - Filed: 2024-04-08 - Published: 2024-10-10 - Granted: 2026-04-14 - Earliest claimed: 2023-04-10 - Assignees: Level 3 Communications, LLC - Applicants: Level 3 Communications, LLC - Inventors: John R.B. Woodworth; Dean Ballew; Lisa Lamanna; James C. Anders; Dan Luther; Carol D. Lovell - Web page: https://patentgrep.com/patent/US12603916B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In a network system in which a server receives packets each including a source address, and in which the server ordinarily responds to each packet, Distributed Denial of Service attacks may be launched by malicious actors controlling a plurality of network devices. In such an attack, the attacking devices may spoof the IP address of a legitimate device, e.g., they may include, in each packet, the source address of the legitimate device. As such, systems and methods for increased security using client address manipulation are provided. ## Claims ### Claim 1 A method, comprising: receiving, by a first network device, a first packet, at a first destination address, the first packet including a source address; and sending, by the first network device, a message to the source address, the message including a second destination address and instructions, the second destination address being unpublished, the instructions instructing the recipient of the message to send subsequent packets to the second destination address, wherein the instructions are transmitted within the network layer of a second packet. ### Claim 2 (depends on 1) The method of claim 1, wherein the first network device is an authoritative name server. ### Claim 3 (depends on 1) The method of claim 1, wherein the first network device is a Domain Name System (DNS) resolver. ### Claim 4 (depends on 1) The method of claim 1, wherein the first packet is a User Datagram Protocol (UDP) packet. ### Claim 5 (depends on 1) The method of claim 1, wherein the instructions further instruct the recipient to, after a set time interval, cease sending subsequent packets to the second destination address and resume sending packets to the first destination address. ### Claim 6 (depends on 1) The method of claim 1, wherein the second packet is an Internet Protocol packet. ### Claim 7 (depends on 1) The method of claim 1, wherein the instructions are transmitted within the transport layer of a second packet. ### Claim 8 (depends on 1) The method of claim 1, further comprising disregarding, by the first network device, a subsequent packet sent to the first destination address. ### Claim 9 (depends on 1) The method of claim 1, further comprising disregarding, by a second network device, a subsequent packet sent to the first destination address, the second network device being connected to the first network device and configured to route packets to the first network device. ### Claim 10 (depends on 1) The method of claim 1, wherein: the first destination address includes a first Internet Protocol address and a first port number; the second destination address includes a second Internet Protocol address and a second port number; and (i) the first Internet Protocol address differs from the second Internet Protocol address; or (ii) the first port number differs from the second port number. ### Claim 11 A network device, comprising: a processing circuit; and memory, operatively connected to the processing circuit and storing instructions that, when executed by the processing circuit, cause the network device to perform a method, the method comprising: receiving, by the network device, a first packet, at a first destination address, the first packet including a source address; receiving notification of a denial of service attack associated with the source address; sending, by the network device, a message to the source address, the message including a second destination address and instructions, the instructions instructing the recipient of the message to send subsequent packets to the second destination address; and sending, by the network device, a message to a network routing device, to drop subsequent packets addressed from the source address and to the first destination address, wherein the instructions are transmitted within the network layer of a second packet. ### Claim 12 (depends on 11) The network device of claim 11, wherein the network device is an authoritative name server. ### Claim 13 (depends on 11) The network device of claim 11, wherein the network device is a Domain Name System (DNS) resolver. ### Claim 14 (depends on 11) The network device of claim 11, wherein the first packet is a User Datagram Protocol (UDP) packet. ### Claim 15 (depends on 11) The network device of claim 11, wherein the instructions further instruct the recipient to, after a set time interval, cease sending subsequent packets to the second destination address and resume sending packets to the first destination address. ### Claim 16 (depends on 11) The network device of claim 11, wherein the second packet is an Internet Protocol packet. ### Claim 17 (depends on 11) The network device of claim 11, wherein the instructions are transmitted within the transport layer of the second packet.