Stateless, simple, edge (leaf) routers
Utilize SYN-FIN pair behavior
Include (SYNACK - FIN) so client or server
However, RST violates SYN-FIN behavior
Placement: First/last mile leaf routers
First mile – detect large DoS attacker
Last mile – detect DDoS attacks that first mile would miss