Ddos Protection?

holyway · #1 06-30-2005, 11:58 PM

Hi! My DC don't have special equipment for dffence from DDos attaks. But they tell me that can do something with IP, that limitede opportunity for DDos attak. What do you know about that?
Thanks!!!

Defcon|Rich · #2 07-01-2005, 12:03 AM

Not sure exactly what your asking but generally most DC's will simply block or nullroute the IP or range that is getting attacked..

holyway · #3 07-01-2005, 01:01 AM

Quote:

Originally posted by X-Gaming
Not sure exactly what your asking but generally most DC's will simply block or nullroute the IP or range that is getting attacked..

Yes! I think, we talk about same thing (nullroute the IP ). It's relly help, when DDos attacked coming?
Thanks!

Servax · #4 07-01-2005, 01:30 AM

That also means your server gets kicked offline... Nullrouting means blocking all access to that IP in which your case would be your server.

holyway · #5 07-01-2005, 01:37 AM

Quote:

Originally posted by Servax
That also means your server gets kicked offline... Nullrouting means blocking all access to that IP in which your case would be your server.

So need doing this only when Ddos attak started???

Defcon|Rich · #6 07-01-2005, 01:37 AM

Yes that is correct.

Kinda hard to run a server thats unplugged

holyway · #7 07-01-2005, 01:41 AM

OK. Thanks to all.
How understand, that your server under DDos attak?

Servax · #8 07-01-2005, 01:44 AM

Well, if your server load is really high.. (Around load averages of 100.00 + depending on your traffic and what your doing) then yeah your under attack.. It can also appear to apache as lots of threads as "?" in the status window for it.

erictanjj · #9 07-01-2005, 02:44 AM

dropping ICMP packets and rejecting certain known IPs where DDoS is coming from could help the attack reduced. Most DDoS comes with ICMP floods, TCP floods or thousands of HTTP requests. But it is just my 2 cents.

Many evils are utilizing IRC servers to build their botnets. They sent out the programs to the victims via email or web download links. And if the victim has successfully installed the program (drone/zombie), that computer will connect to the certain IRC server with the fixed channel owned by the evil. The master there can control all of the drones in that channel. There's thousands of drones were made using of IE bugs, IIS flaws and DCOM bugs. Effective botnet could easily kick out the server offline within a few hours.

Servax · #10 07-01-2005, 02:58 AM

Quote:

Originally posted by erictanjj
dropping ICMP packets and rejecting certain known IPs where DDoS is coming from could help the attack reduced. Most DDoS comes with ICMP floods, TCP floods or thousands of HTTP requests. But it is just my 2 cents.

Many evils are utilizing IRC servers to build their botnets. They sent out the programs to the victims via email or web download links. And if the victim has successfully installed the program (drone/zombie), that computer will connect to the certain IRC server with the fixed channel owned by the evil. The master there can control all of the drones in that channel. There's thousands of drones were made using of IE bugs, IIS flaws and DCOM bugs. Effective botnet could easily kick out the server offline within a few hours.

Yeah, using the command:

iptables -I INPUT -s IP -j DROP

That would make your server drop anything coming from that IP, best way in my opinion to stop an offending IP from even touching your server.

KDAWebServices · #11 07-01-2005, 03:12 AM

Of course you do realise what you've suggested would be useless under a DDoS situation? By the time iptables can do anything, the packets have already got to the server, and are going to eat up CPU time by virtue of iptables and overload the box, or already have completely flooded the servers network connection.

Servax · #12 07-01-2005, 03:15 AM

You could always shutdown apache and see whats on "time_wait" then ban them. Its always seemed to work for me, even when the server load was around averages of 500.00 (It was a Dual Xeon Box).

GeorgeC · #13 07-01-2005, 05:35 AM

Quote:

Originally posted by Servax
You could always shutdown apache and see whats on "time_wait" then ban them. Its always seemed to work for me, even when the server load was around averages of 500.00 (It was a Dual Xeon Box).

Interesting. Can you tell me what commands I would type to see what's on "time_wait" and identify potential DOSers? I'd like to do more than tail my logs when I suspect a DOS.

Servax · #14 07-01-2005, 05:44 AM

I just run:

netstat -an | grep :80

And if I see a lot of connections from an IP (20+) then I copy the IP somewhere in notepad or whatnot. Then after that I just run the command to tell the server to drop the connections coming from the IP(s).

My way must be bitch work, but hey it works.. And if you want.. You could always do a whois record on it and then report it to the ISP..