Date: Thu, 7 Oct 2004 16:37:35 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: "Marc G. Fournier" <scrappy@hub.org> Cc: freebsd-questions@freebsd.org Subject: Re: Reduce effects of DDoS attack ... Message-ID: <20041007153735.GB691@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <20041007120946.K2822@ganymede.hub.org> References: <20041007120946.K2822@ganymede.hub.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--GID0FwUMdk1T2AWN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Thu, Oct 07, 2004 at 12:19:28PM -0300, Marc G. Fournier wrote:
>=20
> I've got 5 servers sitting on a 10/100 unmanaged switch right now ... las=
t=20
> night, a DDoS attack against a network "beside us" cause 70+% packet loss=
=20
> on our network, and I'm trying to figure out if there is anything I can d=
o=20
> from my side to "compensate" for this ...
>=20
> I run ipaudit on all our servers, and a normal 30 minute period looks=20
> like:
>=20
> neptune# gzcat 2004-10-06-22:00.txt.gz | grep 200.046.204 | wc -l
> 12107
> neptune# gzcat 2004-10-06-22:00.txt.gz | grep -v 200.046.204 | wc -l
> 112
> neptune# gzcat 2004-10-06-22:00.txt.gz | wc -l
> 12219
>=20
> where 200.046.204 is our C-class ...
>=20
> Now, when the DDoS attack is running, those stats change to:
>=20
> neptune# gzcat 2004-10-06-17:30.txt.gz | grep 200.046.204 | wc -l
> 5815
> neptune# gzcat 2004-10-06-17:30.txt.gz | grep -v 200.046.204 | wc -l
> 594189
> neptune# gzcat 2004-10-06-17:30.txt.gz | wc -l
> 600004
>=20
> We're getting *alot* of traffic on our network that just is not ours ...
Seems that when the CISCO box upstream gets overloaded it starts
sending packets everywhere, instead of just to the networks they're
intended for.
You could put in a filtering bridge upstream of your unmanaged switch,
which would let you strip out everything not intended for your
assigned subnet. However, as your FreeBSD servers seem to be handling
the load just fine, that probably won't do you much good.
If the switch upstream of you is completely overloaded, there's not a
lot you can do, other than get your network moved over to some less
loaded equipment. =20
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
--GID0FwUMdk1T2AWN
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
iD8DBQFBZWK/iD657aJF7eIRAspBAJ9IXfZWOznX1FEHBH+6IozLGaWB/gCcDiKm
YcZ2C7HEvAfxJEUUObKmBiU=
=Zoc4
-----END PGP SIGNATURE-----
--GID0FwUMdk1T2AWN--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041007153735.GB691>