New answers tagged ddos
A firewall that is overloaded fails closed: it stops mapping or accepting connections as it fails to handle the load.
Those DDOS attacks were performed using a botnet. A botnet is a network of consumer PCs infected with malware. Such botnets are routinely used for a lot of activities, most of them illegal or at least ethically questionable. For that reason the people who control a botnet do their best not to get found. They usually control their botnets using obscure ...
A DDOS-attach is typically executed by sending UDP-messages with a spoofed source-IP to a service which will send a reply to the source-IP given in the incoming message. For example: if IP 188.8.131.52 is running a DNS-server, sending a DNS-query to 184.108.40.206 as an UDP-packet with source-IP set to 220.127.116.11, will result in the DNS-server sending a reply to 18.104.22.168. ...
One reason is that the attackers are using bots which are victims PCs so there is no one source of the attack. Those bots are usually controlled using a Command & Control server, or simple IRC rooms, private Twitter feeds, etc.
If you only allow ONE MAC through a port I can't see how DHCPstarv is going to work (unless it is some kind of distributed DHCPStarv attack). DHCPStarv works by sending a lot of DHCP petitions so that the server doesn't have new IPs to provide to new clients. But if you can only ask for one a time it is not likely the attack is going to succeed. After ...
Moving SSH to an alternate port is not a bad idea. While it won't protect you from a determined attacker who takes the time to run a full portscan, it will in fact prevent 99.9999% of all attacks. The vast majority of all public web servers will never even see a single determined attacker who would take the time to find your SSH port. However, all servers ...
First simple solution is to ban IP address from where the attack is coming. This could be done on router or server itself. Usually afterwards the IP changes and attacks continues. Updated: Another simple solution could be IP filtering. This could be done on router and on server firewall. This is applicable when you use SSH from certain destination only. ...
Considering he's doing full tcp-ip handshakes, installing a HIDS like OSSEC or fail2ban should work quite nicely to autmatically drop this traffic.
A DDoS attack is usually just a shitload of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc... But, knowing that a DDoS is distributed, you'd need to ...
Top 50 recent answers are included