Since more than a week ago, my dedicated server (located in ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load (permanent 100% on the top moments).
I have the option to add a Cisco ASA 5505 on my host and I would like to know if I can really block such attack with it. Does anyone have experience with this firewall?
If I parsed the log correctly I have got something like 550 different IPs spamming TCP SYN packets (18320 packets in total) per minute over two ports. (I can't change these ports, and if I do, the attacker instantly changes his attack too).
At the peak moments, I calculated over 2.000 different IPs (36640 packets) per minute doing exactly the same.
They also do GET attacks on my site, can this Cisco ASA 5505 do something about this?
Also, I would like to know how I can "calculate" the Mbps/Gbps from an attack.
I've tested almost all, blocked all the IPs, changed the server IP, change edports, even remote proxy DDoS protection, but without success.
I recorded this log with WireShark (can be opened with notepad) for over only one minute with 0 "legit" traffic, so all this traffic is the attack. Here is the log.