Date: Thu, 19 Jul 2001 11:24:48 +0200 From: Walter Hop <walter@binity.com> To: FreeBSD ISP <freebsd-isp@freebsd.org> Subject: What do you do about DoS attacks? Message-ID: <17810514298.20010719112448@binity.com>
next in thread | raw e-mail | index | archive | help
Hi all, I am interested in your experience with good ACL's and tools to analyze and prevent DoS attacks, which pose a current problem for me. One of my machines, which is running ircd, has been the subject of frequent DoS attacks for the last few weeks. The box was unaffected until today -- our upstream is getting annoyed by the packets and now cuts off our line when under attack. So, that's an effective DoS we have there. :) There are no log entries of rate-limited ICMP packets. Our upstream's router stats only show that there is about 8Mb/s of traffic coming in, while the traffic on the outside drops (saturated pipe). They can't/do not want to give us information on the traffic, but they can block certain netblocks at the edge on our request. Given that there's probably not much to do about these attacks, I'd still like to: 1] see what types of packets cause the attack The colocated boxes on the subnet are hardly reachable when under attack, so I can't login to make an ad-hoc analysis of the traffic; I want to have a solid logging system in place before another attack occurs. I've replaced net.inet.*.blackhole by .log_in_vain to see if there is anything out of the usual during the attacks. I'd like to keep network dumps under heavy load. Logging all tcpdump output to a file all day would create gigantic file -- is there a tool which can do a (more or less intelligent) analysis of traffic and only log when a problem occurs? (For example, the queues get too large, or incoming traffic exceeds a certain limit) 2] (maybe) discover the origin of the attack The attacks all look the same, so I guess there is one person (or group) behind them. If the attackers are not too intelligent, the source addresses might not be spoofed. Does anyone have any pointers for tools or config options that could help me? [I have tried google and the archives, but did not find anything really valuable this morning..] thanks, walter -- Walter Hop <walter@binity.com> | +31 6 24290808 | Finger for public key To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?17810514298.20010719112448>