From owner-freebsd-questions@FreeBSD.ORG Sat Aug 27 22:48:17 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4000416A41F for ; Sat, 27 Aug 2005 22:48:17 +0000 (GMT) (envelope-from sineathj1@citadel.edu) Received: from imf24aec.mail.bellsouth.net (imf24aec.mail.bellsouth.net [205.152.59.72]) by mx1.FreeBSD.org (Postfix) with ESMTP id 063A943D55 for ; Sat, 27 Aug 2005 22:48:13 +0000 (GMT) (envelope-from sineathj1@citadel.edu) Received: from ibm68aec.bellsouth.net ([70.153.35.66]) by imf24aec.mail.bellsouth.net with ESMTP id <20050827224813.GDGS6137.imf24aec.mail.bellsouth.net@ibm68aec.bellsouth.net> for ; Sat, 27 Aug 2005 18:48:13 -0400 Received: from IBMTWAQPEF2DWZ ([70.153.35.66]) by ibm68aec.bellsouth.net with SMTP id <20050827224813.QGGL27902.ibm68aec.bellsouth.net@IBMTWAQPEF2DWZ>; Sat, 27 Aug 2005 18:48:13 -0400 Message-ID: <003201c5ab59$673d5940$030a000a@IBMTWAQPEF2DWZ> From: "James Bowman Sineath, III" To: "vladone" , References: <1905744288.20050827224121@spaingsm.com><4310C64B.2060807@mkproductions.org> <333541280.20050827235941@spaingsm.com> Date: Sat, 27 Aug 2005 18:48:11 -0400 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Cc: Subject: Re: Re[2]: how to know if i'm under flood? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Aug 2005 22:48:17 -0000 In response to your first question, I would highly recommend setting up a verbose firewall if you have not already done so. Personally, I use ipfw but there are a variety of options available to you (pf/ipf/ipfw/ipfw2), so check out the handbook and figure out which one you want to use. Doing this is a vital step in preventing attacks and keeping track of the connections on your system. There are also a variety of sysctl variables that can help in handling DoS attacks, if you find yourself being flooded on a regular basis then you may want to play with some of them. There are a variety of ways to watch for DoS attacks and floods, but setting up a firewall is a vital part of that. If you need any help doing so then feel free to ask and I would be happy to help (however I am only familiar with ipfw and ipf) but be sure to read the handbook first. > And how exactly use netstat for this purpose? I see many options in > man pages. try netstat -a. I've never used netstat for this purpose but I believe that may work, it will list all of your current connections. If you have a lot of them then you are probably being DoS'd. Bow Sineath Class of 2006, the Citadel sineathj1@citadel.edu - bow.sineath@gmail.com