Re: flood attacks
From: Karsten W. Rohrbach (karsten@rohrbach.de)
Date: 09/29/01
- Next message: Giorgos Keramidas: "Re: protect name services from denial of service?"
- Previous message: Karsten W. Rohrbach: "Re: How to config IPFW for enable ping and traceroute"
- In reply to: Mike Tancsa: "Re: flood attacks"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 29 Sep 2001 01:39:25 +0200 From: "Karsten W. Rohrbach" <karsten@rohrbach.de> To: Mike Tancsa <mike@sentex.net>
just as a sidenote: some people from the net.community, prelude nids
projects and me are currently thinking about implementing a real network
intrusion management system which means that in the future we hopefully
will be able to do active countermeasure stuff concerning dos/ddos
and other network attacks.
there is no single line of code written yet, it's brainstorm and discussion
time at the moment. if you want to join the discussion check the archive
of the list [http://defender.webmonster.de/lists.html] and subscribe ;-)
cheers,
/k
Mike Tancsa(mike@sentex.net)@2001.09.27 12:57:48 +0000:
>
> The problem is that once its in your network, its too late so to speak. You
> want to involve your ISP to get them to limit it before it traverses your
> link. If you are lucky the packets are not random junk and you can block
> on the source IP. Are they hitting the same port ? are they coming from
> random IPs ? As someone said,
> sysctl -w net.inet.tcp.log_in_vain=1
> sysctl -w net.inet.ud.log_in_vain=1
>
> If they are not hitting random ports and hitting say your web server,
> ipfw add 10 count log tcp from any to me 80;sleep 10;ipfw delete 10
> and look at /var/log/security and see where the junk is coming from.
>
> ---Mike
>
> At 01:41 PM 9/27/01 -0300, Ronan Lucio wrote:
> >Hi Dave,
> >
> >But, in my case, I looked at mrtg graphics and saw that
> >it had big flow during 1 hour.
> >So, I supposed to prevent such situation.
> >
> >[ ]īs
> >
> >Ronan Lucio
> >
> > > > Limiting closed port RST response from 1800 to 200 packets per
> >second.
> > >
> > > Awhile back, I managed to reproduce this by portscanning myself with a
> > > very fast scanner which doesn't wait for any kind of response from the
> > > server before testing the next port. The 1800 to 200 message thing sounds
> > > quite general, so you could be getting flooded with lots of different
> > > kinds of data. If the messages come in briefly and then stop for awhile
> > > (rather than a continus flow) you could just be getting a fast port scan.
> > >
> > >
> > > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > > with "unsubscribe freebsd-security" in the body of the message
> > >
> > >
> >
> >
> >To Unsubscribe: send mail to majordomo@FreeBSD.org
> >with "unsubscribe freebsd-security" in the body of the message
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
-- > Nuclear war can ruin your whole compile. --Karl Lehenbauer KR433/KR11-RIPE -- WebMonster Community Founder -- nGENn GmbH Senior Techie http://www.webmonster.de/ -- ftp://ftp.webmonster.de/ -- http://www.ngenn.net/ karsten&rohrbach.de -- alpha&ngenn.net -- alpha&scene.org -- catch@spam.de GnuPG 0x2964BF46 2001-03-15 42F9 9FFF 50D4 2F38 DBEE DF22 3340 4F4E 2964 BF46 Please do not remove my address from To: and Cc: fields in mailing lists. 10x
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
- application/pgp-signature attachment: stored
- Next message: Giorgos Keramidas: "Re: protect name services from denial of service?"
- Previous message: Karsten W. Rohrbach: "Re: How to config IPFW for enable ping and traceroute"
- In reply to: Mike Tancsa: "Re: flood attacks"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
