0

I am creating WebSocket server with rust and tokio and I want to prevent DDos attacks and spams.

So I thought of creating HashMap and inserting IP address for 1 hour which i suspect is trying to do spamming or DDos Attack but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?

If I ban IP address and port combination, will the attacker just use other port?

1
  • 2
    Yes. And yes. ... – user253751 Aug 9 '20 at 14:56
5

but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?

If you ban an address, you ban everyone using that address. So yes, you could end up incidentally banning a lot of users, especially on large NAT'ed networks (e.g. mobile carrier-grade NAT).

If I ban IP address and port combination, will the attacker just use other port?

Typically, the client's OS networking stack will use a new, random source port for every connection. So an attacker probably wouldn't even need to try to bypass this restriction.

2
  • Does this port discussion even make sense if we take routing into consideration? The source port will come from the router/firewall device and it will not be the same as the attacker port right? – Kamil Kurzynowski Aug 15 '20 at 19:32
  • @KamilKurzynowski ports and routing don't really relate. But your statement depends on the exact setup (e.g. IPv4 vs IPv6, using a public host or not) – multithr3at3d Aug 15 '20 at 23:43
1

IP restrictions are not good against DDOS they could work for DOS scenarios. DDOS is a distributed denial of service which means that the attacker utilizes multiple sources when attacking your infrastructure (a botnet of smart devices is a great example) and that means multiple IP addresses making connections that look legitimate. This is a great problem across the whole industry and it can't be solved at the endpoint as a proper DDOS attack would bring down your router/firewall before ever reaching the server, also congestion is a big issue. The attacker can occupy all your bandwidth by generating queries, so even if your devices do not go down, legitimate users will not have a way of accessing your services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.