0

I am creating WebSocket server with rust and tokio and I want to prevent DDos attacks and spams.

So I thought of creating HashMap and inserting IP address for 1 hour which i suspect is trying to do spamming or DDos Attack but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?

If I ban IP address and port combination, will the attacker just use other port?

1
  • 2
    Yes. And yes. ...
    – user253751
    Aug 9, 2020 at 14:56

2 Answers 2

5

but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?

If you ban an address, you ban everyone using that address. So yes, you could end up incidentally banning a lot of users, especially on large NAT'ed networks (e.g. mobile carrier-grade NAT).

If I ban IP address and port combination, will the attacker just use other port?

Typically, the client's OS networking stack will use a new, random source port for every connection. So an attacker probably wouldn't even need to try to bypass this restriction.

2
  • Does this port discussion even make sense if we take routing into consideration? The source port will come from the router/firewall device and it will not be the same as the attacker port right?
    – nethero
    Aug 15, 2020 at 19:32
  • @KamilKurzynowski ports and routing don't really relate. But your statement depends on the exact setup (e.g. IPv4 vs IPv6, using a public host or not) Aug 15, 2020 at 23:43
1

IP restrictions are not good against DDOS they could work for DOS scenarios. DDOS is a distributed denial of service which means that the attacker utilizes multiple sources when attacking your infrastructure (a botnet of smart devices is a great example) and that means multiple IP addresses making connections that look legitimate. This is a great problem across the whole industry and it can't be solved at the endpoint as a proper DDOS attack would bring down your router/firewall before ever reaching the server, also congestion is a big issue. The attacker can occupy all your bandwidth by generating queries, so even if your devices do not go down, legitimate users will not have a way of accessing your services.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .