1

I installed VM centOS 6.8 then I installed hping3 tools. With this tool, I can take down any PC connection on the network as well as increase CPU and RAM usage with the following command

hping3 --flood -S xxx.xxx.xxx.xxx

I have done a lot of search on Google, and most of the people advise to follow these steps to add/modify the registry

To do that, open Windows registry editor and go to this registry path

HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters

Create "DisableIPSourceRouting" Data Type " REG_DWORD" Set Value To "2"

Create "IPEnableRouter" Data type "REG_DWORD" Set Value "0"

Create "SynAttackProtect" Date type "REG_DWORD" Set type "3"

Create "TcpMaxConnectResponseRetransmissions" Data type "REG_DWORD" Set Value "1"

Create "TcpMaxHalfOpen" Data type "REG_DWORD" Set Value "500"

Create "TcpMaxHalfOpenRetried"  Data type "REG_DWORD" Set Value "400"

But unfortunately even I have added those, I still can do this kind of attack.

More information, I'm using Symantec endpoint security 14, and I have enabled " Enable denial of service detection "

Any assistance would be greatly appreciated

Improve this question
2
  • Are you fearing external attacks or is this really about what is happening in your local network?
    – davidb
    Commented Dec 27, 2016 at 16:25
  • It happened on my local network. Do you have any solutions?
    – Fanar AL HAYALI
    Commented Dec 28, 2016 at 7:28

3 Answers 3

Reset to default
3

The registry settings that you list are for particular types of mal-formed traffic that can cause DoS. But what you are doing is sending more traffic than the destination can handle. All the packets are properly formed. There is no registry setting to protect against high-volume floods.

To protect something from a flood, you need something in between that can hold the flood back. Like a router.

Improve this answer
2
  • Thanks for the explanation. But those attacks are coming from my internal network, and there isn't a firewall. Do you know a software that could protect my users? As I mentioned before all PC are installed Symantec endpoint security 14
    – Fanar AL HAYALI
    Commented Dec 28, 2016 at 7:31
  • That's my whole point. An internal machine flooding and internal machine is very difficult to stop. You need another machine in the middle. This isn't a situation for software to fix, you need a network-level solution.
    – schroeder ♦
    Commented Dec 28, 2016 at 7:33
0

Maybe a firewall and IDS/IPS will help. It will block the IP throwing high packets to destination i.e. your machine. Or else block ICMP protocol or ping.

Improve this answer
1
  • Any firewall and IDS/IPS software suggestions?
    – Fanar AL HAYALI
    Commented Dec 28, 2016 at 7:33
0

To guard against DoS/DDoS attacks, configure the maximum number of new sessions and the allowed total number of sessions from a single source (Max. Number of Sessions/Max. Number of Sessions per Source) to protect against resource exhaustion. These settings are also configured on a per-rule basis.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .