Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am creating WebSocket server with rust and tokio and I want to prevent DDos attacks and spams.
So I thought of creating HashMap and inserting IP address for 1 hour which i suspect is trying to do spamming or DDos Attack but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?
If I ban IP address and port combination, will the attacker just use other port?
but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?
If you ban an address, you ban everyone using that address. So yes, you could end up incidentally banning a lot of users, especially on large NAT'ed networks (e.g. mobile carrier-grade NAT).
If I ban IP address and port combination, will the attacker just use other port?
Typically, the client's OS networking stack will use a new, random source port for every connection. So an attacker probably wouldn't even need to try to bypass this restriction.
IP restrictions are not good against DDOS they could work for DOS scenarios. DDOS is a distributed denial of service which means that the attacker utilizes multiple sources when attacking your infrastructure (a botnet of smart devices is a great example) and that means multiple IP addresses making connections that look legitimate. This is a great problem across the whole industry and it can't be solved at the endpoint as a proper DDOS attack would bring down your router/firewall before ever reaching the server, also congestion is a big issue. The attacker can occupy all your bandwidth by generating queries, so even if your devices do not go down, legitimate users will not have a way of accessing your services.
