Date: Sat, 7 Feb 2004 12:02:19 +0100 From: "Remko Lodder" <remko@elvandar.org> To: "Spades" <spades@galaxynet.org>, <freebsd-security@freebsd.org> Subject: RE: [Freebsd-security] Re: IPFIREWALL Message-ID: <20040207110224.48A122B4D7C@mail.evilcoder.org> In-Reply-To: <20040207063015.2BF733F@mail.elvandar.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, I dont think you can deny all ddos against your box, you will need help from your isp. That is because if a person sends you enough packets, like 1mbit (and your line is 1mbit) full of packets, your connection is stuck, whether you filter or not. Though you can mitigate those by closing all non needed ports, log them if any attempt is being made to connect to them, and use a bogon list which filters out traffic that come from unused ip-ranges. Note that DDOS not only happends due icmp, but can also means attacking TCP/UDP and other protocols as well. I don't know how it is done by IPFW, but iptables can limit syn connections (again i don't know how it's done since i dont have any experience with it, but it can do it) Also you can use stuff like snmp for example to monitor traffic in combination with mrtg that is a good start. Hope it helped you a little, -- Kind regards, Remko Lodder Elvandar.org/DSINet.org www.mostly-harmless.nl Dutch community for helping newcomers on the hackerscene -----Oorspronkelijk bericht----- Van: freebsd-security-bounces@lists.elvandar.org [mailto:freebsd-security-bounces@lists.elvandar.org]Namens Spades Verzonden: zaterdag 7 februari 2004 7:29 Aan: freebsd-security@freebsd.org Onderwerp: [Freebsd-security] Re: IPFIREWALL Heya, lately my freebsd connection is being slow'd down after it got ddos by some kiddies, and i got this feeling it is still being packetted by in small amt cos i can feel a constant lag. i have ipfw running and denied all icmp Any idea how i can secure my box against all ddos and prevent syn or other kind of floods? anyway to monitor packets as well? Thanks & regards. _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" _______________________________________________ Freebsd-security mailing list Freebsd-security@lists.elvandar.org http://lists.elvandar.org/mailman/listinfo/freebsd-security
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040207110224.48A122B4D7C>