How to protect myself against paid DDoS services?

Question

I am domestic user and I am getting attacked regularly by a guy that hates me.

Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP based on my Skype ID. He does that because I have dynamic IP, so whenever I go online and sign in to Skype, he discovers my new IP using the Skype resolver. Now I know I could avoid this by creating a new Skype ID (which I did) or by using a proxy service for Skype (which is not always convenient), but I wonder how I could prevent the attacks if he discovered my IP through other means.

What I know for sure is that he is using 2-3 paid DDoS services, so he's not conducting the attack from his PC. I have 100 Mbps download and upload capabilities, my CPU is a Core i7-920 (2.7 GHz quad-core) and I am using the Jetico Personal Firewall, and I am on Window 7 x64. When I am getting attacked, there is not much bandwidth use, but the CPU gets stressed up to 50-60% and I am not able to access any internet resources (browsing doesn't work, chat clients go offline, etc.) The firewall does its best to reject the attacks (as you can see in the screen shot bellow), it doesn't crash or hang, but it is not enough. My Internet connection is bridged, so he's not attacking a router, all the packets hit my system directly. Either way, I don't think a router could do better.

As you can see, all the packets are incoming 40 bytes TCP packets, sent through port 1234 and hitting port 80 on my system (I do not have any service listening on that port, and even if I were, I wouldn't let it be accessed from the outside). I think that the source IPs are spoofed addresses as they come from all over the world. During an attack I get millions of such packets and the only way to stop the attack is by disconnecting from the internet and reconnecting (with a different IP).

My question: is there any way I can protect myself against such an attack without having to disconnect from the Internet and suffer major CPU stressing?

Answer 1

Have a dedicated router or firewall to do the filtering.

The reason your CPU is being stressed is that the software firewall on your system is attempting to handle way more packets that your system can tolerate.

Having a hardware router or firewall drop packets before they hit your computer should do the trick. Of course, there IS a limit even to dedicated routers or firewalls. So it really comes down to how much resources the attacker is willing to use to DDoS you.

Besides that, there is really nothing else you can do to stop an attacker, besides coordinating with your ISP to block the incoming packets or reporting the matter to law enforcement.

Answer 2

In your current setup, the first thing you can do is to add rule to drop this specific traffic. I don't know firewall product you're using, so YMMV.

• rule shall be based on layer 3 - layer 4 properties, i.e. src port 1234 and dst port 80
• rule shall be placed on top of ruleset - that may help with CPU
• rule shall silently drop the traffic (not reject), for two reasons:
  • sending resets eats your bandwidth and cpu
  • sending resets confirms that your host is active and asks for more

For this particular scenario - small, managed switch with access list(s)may do a brilliant job, i.e. something like Cisco 2960-C fanless, compact series.

Answer 3

@LucasKauffman Sorry to disagree but no DDoS mitigation service I know of costs "few hundred thousand dollars"...

A reverse proxy PCI DDS compliant Web Application Firewall (talking about the best of it's kind) will only set you back a few dozen bucks a month and even full blown Network DDoS mitigation will usually cost under 1,000$ (unless you are trying to prevent a really heavy attack, but even then it will be few thousand dollars at the most).

In this case I think we are looking at a small Network DDoS, performed by one (or more) botnets.

Small attacks can be countered by router, like @Terry_Chia suggested. (+1 btw) But larger DDoS attacks will still hit you hard.

It would be very interesting and educational to learn more about this case.

@IneedHelp, How did you resolve this issue?