Timeline for Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
Current License: CC BY-SA 3.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 8, 2018 at 14:13 | vote | accept | Jon Ferguson | ||
| Jan 31, 2018 at 2:53 | answer | added | Slartibartfast | timeline score: 3 | |
| S Jan 31, 2018 at 2:25 | history | suggested | ximaera |
Better tags
|
|
| Jan 31, 2018 at 1:58 | history | tweeted | twitter.com/StackSecurity/status/958519760379170816 | ||
| Jan 30, 2018 at 23:51 | comment | added | ximaera | @Mark RFC 4732 even explicitly points out the difference between "a sufficiently subtle DoS attack and a flash crowd (where unexpected heavy but non-malicious traffic has the same effect as a DoS attack)". The latter is essentially your case. | |
| Jan 30, 2018 at 23:47 | comment | added | ximaera | @Mark you must be kidding. Take, I don't know, RFC 4732: a Denial-of-Service (DoS) attack is an attack in which one or more machines target a victim and attempt to prevent the victim from doing useful work. Take US-CERT, CERT/CC or a vendor's site: as broad as those definitions are, each of them implies an intentional attempt. Yours is just an occasional operations failure. | |
| Jan 30, 2018 at 23:31 | comment | added | Mark | @ximaera, yesterday. It probably wasn't intentional -- I think they were trying to clone the site instead of knock it offline -- but hitting a low-powered webserver with enough traffic certainly acts as a denial of service attack. | |
| Jan 30, 2018 at 23:14 | comment | added | cybernard | Just because you block the traffic, doesn't mean it isn't there. An attacker can still flood you with traffic which blocks legit connections. The firewall just means nothing on the inside of the firewall will every see the traffic. | |
| Jan 30, 2018 at 22:59 | comment | added | ximaera | @Mark when was the last time you've seen a _DoS attack in real life? | |
| Jan 30, 2018 at 22:54 | comment | added | Mark | @ximaera, just because you have trouble telling DoS and DDoS attacks apart doesn't mean they're the same thing. | |
| Jan 30, 2018 at 22:50 | comment | added | ximaera | What's the reason of explicitly excluding DDoS from your question? With this, the question actually becomes purely theoretical, and Fail2Ban just isn't there to solve theoretical issues. See my answer below. | |
| Jan 30, 2018 at 22:18 | review | Suggested edits | |||
| S Jan 31, 2018 at 2:25 | |||||
| Jan 30, 2018 at 22:17 | answer | added | ximaera | timeline score: 0 | |
| Jan 30, 2018 at 19:30 | answer | added | dFrancisco | timeline score: 0 | |
| Jan 30, 2018 at 18:39 | comment | added | AndrolGenhald | DoS attacks aren't all based on bandwidth, you could perform a DoS attack by making a request that requires a large amount of processing. Fail2Ban would mitigate this sort of DoS by preventing such repeated requests from reaching the application doing the processing. | |
| Jan 30, 2018 at 18:31 | review | First posts | |||
| Jan 30, 2018 at 18:47 | |||||
| Jan 30, 2018 at 18:30 | history | asked | Jon Ferguson | CC BY-SA 3.0 |