Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors should you know before you choose the suitable hardware firewall like the amount of this DDOS and pps ..etc

Please suggest a linux tools to measure those factors and to help me collect the required informations ( pps - amount of DDOS - concurrent connections and other factors )

Regards,

share|improve this question
1  
I'm curious why you have already decided on the 5500 series before you know whether it will even be capable of what you ask. –  Ladadadada Jun 4 '12 at 19:47
    
We generally discourage cross-posting unless you expect very different audiences. I have asked the Unix&Linux mods whether we should merge. –  Rory Alsop Jun 5 '12 at 8:59
    
Also, the headline appears to be different to the question. Do you want to know what factors should guide your decision? Or do you want to know some linux tools? –  Rory Alsop Jun 5 '12 at 9:00
    
@Ladadadada Are there other cisco firewall would help in DDOS .? as Cisco ASA 5500 are series not only one model. –  linuxcore Jun 5 '12 at 9:04
    
@RoryAlsop I changed the question title to be more clear. –  linuxcore Jun 5 '12 at 9:04

1 Answer 1

up vote 2 down vote accepted

Having recently had my 5510 taken down in a SYN-flood DDoS, the key thing you need to know is how big the DDoS is going to be.

Our ASA 5510 hit its limit at 140,000 packets per second. Although the specs say 190,000 packets per second, other factors can influence the actual rate achieved. The 5505 can handle fewer packets per second than the 5510. Higher models can handle more.

We may have had the resources at the back end to handle that many connections, but since the firewall was the bottleneck, we never got to find out.

There are other types of DDoS and other bottlenecks you can run into. Some of them involve lots of bandwidth and fewer packets. Some specifically target inbound or outbound bandwidth. Some make relatively few requests but since they are attacking your application rather than your network, a few requests is enough.

If you plan on identifying the IP addresses and blocking them at your firewall you will want a few things in place before the DDoS hits:

  1. Out of band access. If they knock out your network, you can't SSH or RDP in. Make sure you have another way in. This may include a second internal network as the attack may have taken down the internal network.
  2. Analysis tools. Splunk and Graylog are two options with free versions. Good SIEM tools are usually expensive but more suited to the task. Your goal here is to verify that it is actually a deliberate DDoS and find the pattern that allows you to extract the IP addresses. Make sure all your logs are already in these tools and you are familiar with using them.
  3. Scriptable firewall updates. Botnets can be large. SYN-floods can have spoofed IP addresses. We saw over 100,000 uniques in a ten minute period. You will want a script that can take a list of IP addresses and add them all to the firewall. You will also want these in tables to avoid the firewall having to scan through all 100,000 entries before allowing or denying a packet.
  4. Out-of-band Public Relations. Have an official Twitter account or Facebook page or mailing list (with no reliance on your main network) that your customers subscribe to so you can let them know why you're down.
  5. A backup plan. If your guesses about what you might need are wrong or if you just can't find the pattern, there are DDoS protection services available that can take over... for a price. Make sure you know which one of these you would choose and you know how to hand control over to them. You will also want to evaluate the cost of downtime vs. the cost of paying for the protection. Depending on your business, it may be better just to accept the downtime.
share|improve this answer
    
+1 for the DDoS protection service. If someone wants to DDoS you an ASA will not be enough. –  Rory Alsop Jun 4 '12 at 21:58
    
It really depends on the scale. I had one a couple of months ago that was three IP addresses and about 30 requests per second using the High Orbit Ion Cannon. Not everyone who wants to DDoS you has a 10,000 strong botnet. :-) –  Ladadadada Jun 4 '12 at 23:18
    
@RoryAlsop Could you suggest another cisco solution .? –  linuxcore Jun 5 '12 at 9:05
    
As @ladadadada said, it could cope with a small DDoS. If you have a large attack no router will be enough, and you'll need to use a DDoS mitigation provider. See our other questions tagged DDoS. –  Rory Alsop Jun 5 '12 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.