5

Since more than a week ago, my dedicated server (located in ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load (permanent 100% on the top moments).

I have the option to add a Cisco ASA 5505 on my host and I would like to know if I can really block such attack with it. Does anyone have experience with this firewall?

If I parsed the log correctly I have got something like 550 different IPs spamming TCP SYN packets (18320 packets in total) per minute over two ports. (I can't change these ports, and if I do, the attacker instantly changes his attack too).

At the peak moments, I calculated over 2.000 different IPs (36640 packets) per minute doing exactly the same.

They also do GET attacks on my site, can this Cisco ASA 5505 do something about this?

Also, I would like to know how I can "calculate" the Mbps/Gbps from an attack.

I've tested almost all, blocked all the IPs, changed the server IP, change edports, even remote proxy DDoS protection, but without success.

I recorded this log with WireShark (can be opened with notepad) for over only one minute with 0 "legit" traffic, so all this traffic is the attack. Here is the log.

Improve this question
5

You have a number of separate queries here, so I'll try and get through them.

If you have the IP addresses then yes, you can get the 5505 to block - that's pretty simple - just add the IP addresses to the block list (or depending on your needs, block everything except traffic from known good IP's - whitelisting)

Cisco offer SYN Flood protection - worth looking at to see if it fits your particular situation. It's very basic, but works very well for certain scenarios.

A 5505 will not help on the GET request - you'd need a Deep Inspect capable firewall. Depending on your webserver, you may be able to do this here.

You say the proxy ddos mitigation was not useful. This is actually a very useful and successful solution thousands of companies use, so maybe you need to look at how you are using it.

Improve this answer
  • I wish these guys just asked you for advice first! – Matthew Peters Nov 6 '15 at 12:53
  • This is a problem which is very solvable at enterprise level, and even mid-sized business - Companies like Akamai/Prolexic or Cloudflare offer these. May be outside a small business budget though. – Rory Alsop♦ Nov 6 '15 at 13:05
  • IMO small businesses that actually need the coverage can afford it but more importantly, they cannot not afford having protection... – Matthew Peters Nov 6 '15 at 13:33
  • 1
    Oh, I agree that certain levels of protection are possible at small scale,and should be implemented if your web application needs to be available. But it isn't a patch on the protection a large org can get. – Rory Alsop♦ Nov 6 '15 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.