I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
So in case my Bind / Centos DNS server will handle denial of service in form of stream of UDP packets from multiple host at once, there is 10GBps interface on this machine to handle large amounts of incoming packets, and the ip tables can handle many hosts.
Is there any tool / method to actually do it? I know there is LOG, should I use this, or there is some module which would be better fit for this?
Simply each IP number with excess rate of UDP queries above some no. of requests per second is added to the blacklisted file, and based on that file IPTables chain is generated.
So my question is, how to log excessive rates from particular hosts and log them, and make it high performance, assuming all IPv4 numbers would fit into RAM?
The main thing would be to count no of packets / sessions / opened connections during hour from a single host and blacklist them.
I am looking for example source code / IPTABLES rules for port 53 which would allow 1000 requests per hour from single IP address to DNS server with Bind.
Also to keep the whitelist of permitted hosts at the same time, so during attack I can blacklist everyone while the most used DNS servers are OK, this would work in case the attacked is spoofed and every request comes from different IP address which should be also detected.
I cant make anycast service at the moment, however I need some protection on DNS to avoid DDoS, which happens from time to time.
UPDATE: There is Cisco Guard product actually doing the same, but I want this on every Linux machine. It is because Linux can handle it, so this is only problem of good software to do it.