3

A few weeks ago I reported a small botnet which is coming from the network of a big Internet provider.

They asked me for more details which I provided. But the attack is going for weeks already and from our side it looks like they haven't done any action to stop it.

Because traffic follows very specific patterns, we managed to split and block most of it with fail2ban, but still every day we are adding new IPS to block - so far we have banned around 1700 IPS.

I expect them to inform their customers about being part of the botnet and also stop the bad traffic hitting our servers. Is it a reasonable expectation?

How long does it usually take for bigger internet providers to perform any actions against botnet?

How to successfully report DoS attack incoming from Big ISP?

I would like also to hear how in reality such requests are processed by bigger ISPs. From my current experience (it's not the first time) looks like abuse reports are to great extend ignored.

3

ICANN has a good article on this. Read it.

But because you seem to only be under attack from a specific ISP, I can tell you some more.

Most people have dynamic IP addresses. This means that their IP changes after at most 24 hours. So everything you banned more than 24 hours ago shouldn't be banned any more because for every given IP banned more thin 24 hours ago, now someone else has the the banned IP and can't access your service even though they didn't do anything wrong. So your policy doesn't make sense.

A better approach would be to ban all IP address blocks of the ISP you have trouble with. Then no one using that ISP can access your service and you don't have to worry about the DDoS attacks.

However, a smarter approach is to ban dynamically and for a short period of time. Enforcing a ban forever hurts others and makes your list of banned IP addresses very long, therefore it takes a long time to compare the IP address a request came from to your list.

  • I don't block them infinitely only for around 96 hours. I don't understand how is a better approach to ban every IP address from the ISP. But the link you provided is very good, Thanks. – Pawel Dubiel Apr 4 '16 at 12:10
  • This would make your list shorter so it takes less time and fewer resources to go through it. – UTF-8 Apr 4 '16 at 13:44
  • If your service is desired by the ISP's customers, banning their entire block may hurt them where it counts; in their pocketbook. If their customers complain or migrate to another ISP because they are blocked from a service they want, the loss of revenue may cause them to spend the resources to block the attacks. Unfortunately this solution is related to the relative size/desirability of your system to the ISP's. Won't work well if you are dinky and they are giant. If Google blocks them in this way, see how fast they clean up their act. – Mark Ripley Dec 2 '16 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.