Carpet bombing attacks are a new variant of the more common reflection or flooding attacks, where instead of focusing the attack on a single destination, the attacker attacks every destination within a specific subnet or CIDR block (for example, a /20). This will both make it more difficult to detect the attack and also to mitigate it, potentially resulting in outages due to the flood of attack traffic across network devices and internal links.

In addition, these attacks are often fragmented, resulting in a flood of non-initial IP fragments, which can be tricky to mitigate. The attacker will often shift their attacks from one subnet (or CIDR block) to another, complicating the detection and mitigation even further.

Very similar to Carpetbombing in terms of target selection, the Chewie attack brings more randomness to the game by choosing target, strength, vector and protocol completely at random.

This ensures that pure statistics-based detection methods are completely confused, as the packet stream from an attack IP never lasts longer than 30 seconds, and then stops for at least 120 seconds, only to start again with a new target and pattern.

Although only 25% of the bots in a botnet are active at any one time, the attack is much more difficult to defend against