From owner-freebsd-hackers Sun Jan 5 23:22:14 2003 Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EF41E37B401 for ; Sun, 5 Jan 2003 23:22:13 -0800 (PST) Received: from 002.216-123-229-0.interbaun.com (002.216-123-229-0.interbaun.com [216.123.229.2]) by mx1.FreeBSD.org (Postfix) with ESMTP id 46B1443EC5 for ; Sun, 5 Jan 2003 23:22:13 -0800 (PST) (envelope-from soralx@cydem.zp.ua) Received: from 128.216-123-229-0.interbaun.com (vasya [192.168.0.3]) by 002.216-123-229-0.interbaun.com (8.11.6/8.11.6) with ESMTP id h067MC621243 for ; Mon, 6 Jan 2003 00:22:12 -0700 (MST) (envelope-from soralx@cydem.zp.ua) Content-Type: text/plain; charset="iso-8859-1" From: To: freebsd-hackers@FreeBSD.ORG Subject: Re: DDoS attacks, packets captured ... not sure what to do. Date: Mon, 6 Jan 2003 00:21:39 -0700 X-Mailer: KMail [version 1.4] References: <20030105145150.N80512-100000@mail.econolodgetulsa.com> <200301052332.59925.soralx@cydem.zp.ua> <3E192770.43B3D489@mindspring.com> In-Reply-To: <3E192770.43B3D489@mindspring.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-Id: <200301060021.39502.soralx@cydem.zp.ua> Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > Another useful thing to do is limit the number of connections per > second from a given source IP address, and to limit the total number > of connection "in progress" from a given IP address. I doubt that all the packets are sent from one real IP. But, I tnink, it may be possible to determine the IP of an attacker, because it's not just a DoS attack. He may use other methods later. I am almost sure he tried to scan ports earlier, probably with `nmap -v -O` to determine the OS, and now he knows what packets to send. BTW, what were the UDP packets for? Scanning? 06.01.2003; 00:14:26 [SorAlx] http://cydem.zp.ua/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message