1

I need to code a program in order to detect a DDOS attack. I'm not sure what's better:

1) use TCPDUMP in order to listen to the interface

2) code my own way to listen to the interface (using C language, for example).

May someone help me with some ideas of how to start my DDOS detector? I didn't find any text of how to do that?

I'm not interested in the language, but about the ideas of how to detect a DDOS.

EDIT

There's something I forgot to say: I have one server that receives all the traffic from the router (through mirroring). So, if the routers goes down, I can still send the notification to another server to notify there is a DDoS.

closed as too broad by wireghoul, Gilles, Anders, Matthew, Stephane Feb 20 '17 at 12:14

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    You typically do not need to 'detect' a DDoS, it becomes painfully obvious when your server is at 100% CPU and Memory usage. That's why you won't find code to 'detect' it - because in a DDoS, the code won't run ... – schroeder Feb 10 '17 at 21:14
  • 1
    The first "D" in DDoS is "distributed", it's just a characteristic of a DoS. To determine if the DoS attack is distributed, you inspect the logs. But the real point is the DoS, which is easy to spot (i.e. "no service") – schroeder Feb 10 '17 at 21:16
  • Typical DDoS these days simply over saturate your connection, and if conducted by a large enough botnets could even take your service provider offline. Detecting this is as simple as detecting your connection being down, but you're unable to send information out and the issue is typically solved with a null route further upstream. So I don't see how your program will help the situation at all. External connectivity monitoring is just as effective and a well serviced area. – wireghoul Feb 12 '17 at 9:13
8

I'd try to go with established tools first, before writing my own networking interface monitoring code.

Chances are that if you're trying to protect a server, you'll be helpless against a sufficiently large DDoS anyway (someone further up the routing chain will have to take action to null-route attacks), so the main argument in favor of writing your own C code, efficient detection, isn't very strong).

(The above paragraph doesn't apply if you're trying to detect a DDoS flowing through specialized hardware, like large routers - in such a case, you'd be part of the effort to stop a DDoS before it reached it's target, and efficiency would be your prime concern - but I'd be disappointed if high-capacity routers didn't already have such capabilities built-in)

Besides tcpdump, you could also use netstat (to get a quick idea about the number of connections or connections in a zombie state), iptables (both to log packets and then act on the log, and to drop suspicious packets immediately) and fail2ban (you can configure it to count, say, HTTP GET requests or SSH connection attempts etc, and then automatically ban the IPs in question, and of course also produce log messages that an additional DDoS detection script can the pick up and use to notify you).

One problem with basing detection code for a DDoS on the server that's being DDoSed is that if you're counting on the server to notify you of the attack over the network, you might get disappointed because the server might not have the CPU resources or the bandwith available to send out a notification any more. So you'd need to have a secondary means of communication, say a GSM modem over which to notify you (and that's assuming that the server still has the CPU resources available to run your notification code).

There's another, very easy and much more promising way to create a DDoS monitor: Set up a small script on another server that periodically tries to connect to your server. If it fails to connect, you can assume that either your server is down, the network between your server and your monitor is down, or that there is a DDoS in progress. Going this route, you don't even have to write any software at all; just subscribe to an online service that checks service uptimes. There's a lot of them available, some of them even for free.

  • Thank you for the answer. There's something I forgot to say: I have one server that receives all the traffic from the router (through mirroring). So, if the routers goes down, I can still send the notification to another server to notify there is a DDoS. – Paulo Feb 13 '17 at 11:33
  • 1
    @Paulo: I'm not sure I understand. I'd still suggest to use a third party online service . That models the experience of your users best. If you monitor locally and your ISP cuts off traffic to your server at their network boundary because it threatens their operation, your local monitor will suddenly see no traffic at all, and no replies to any ping to the internet. – Pascal Feb 13 '17 at 12:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.