Can a Cisco ASA 5505 block this DDoS attack?

Question

Since more than a week ago, my dedicated server (located in ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load (permanent 100% on the top moments).

I have the option to add a Cisco ASA 5505 on my host and I would like to know if I can really block such attack with it. Does anyone have experience with this firewall?

If I parsed the log correctly I have got something like 550 different IPs spamming TCP SYN packets (18320 packets in total) per minute over two ports. (I can't change these ports, and if I do, the attacker instantly changes his attack too).

At the peak moments, I calculated over 2.000 different IPs (36640 packets) per minute doing exactly the same.

They also do GET attacks on my site, can this Cisco ASA 5505 do something about this?

Also, I would like to know how I can "calculate" the Mbps/Gbps from an attack.

I've tested almost all, blocked all the IPs, changed the server IP, change edports, even remote proxy DDoS protection, but without success.

I recorded this log with WireShark (can be opened with notepad) for over only one minute with 0 "legit" traffic, so all this traffic is the attack. Here is the log.

Answer 1

You have a number of separate queries here, so I'll try and get through them.

If you have the IP addresses then yes, you can get the 5505 to block - that's pretty simple - just add the IP addresses to the block list (or depending on your needs, block everything except traffic from known good IP's - whitelisting)

Cisco offer SYN Flood protection - worth looking at to see if it fits your particular situation. It's very basic, but works very well for certain scenarios.

A 5505 will not help on the GET request - you'd need a Deep Inspect capable firewall. Depending on your webserver, you may be able to do this here.

You say the proxy ddos mitigation was not useful. This is actually a very useful and successful solution thousands of companies use, so maybe you need to look at how you are using it.