[jsnell]

Yes, the attackers will obviously open many connections. In fact, they've always opened as many connections as they have resources for.

But establishing a connection is extremely expensive compared to sending data on an already established channel. With this method they need to open far fewer connections for the same qps.

There's no need to confuse the issue by trying to diagram multiple connections at the same time.