How stop DoS and SYN attack..
jhpark-nf-user at kernelproject.org
Tue Jun 6 19:22:58 CEST 2006
Alberto Ferrer wrote:
> ¿So its impossible stop a DDoS ? (SYN Flood in my case.)
if you limit DDos to the TCP SYN flood, you may be right
but there are so many DDos patterns not based TCP..
so if you make enable tcp_sync_cookies flag of your kernel, you can
protect TCP sync attack,
but as time goes on, your system and network will be stoped. so that
solution can't solve the problem basically
( please refer to the "sietse van zanen"'s post and
in the DDOS problem, i think QoS or my idea dropping any flooding
packet in NIC driver layer may give a more general solution than
IP-based netfilter. there are so many paper to solve this DDos, but as
i know there is none exact solution to resolve this DDos exactly.
> 2006/6/6, Jeho Park <jhpark-nf-user at kernelproject.org>:
>> Sietse van Zanen wrote:
>> >There's not really very much you can do about DDOS attacks with
>> netfilter alone. You can block the traffic ofcourse, or try to fiddle
>> with --limit, or tcp_syn_cookies.
>> i think as a attacker try to send more and more sync packets, router
>> will lose cpu time and system resource .. even if tcp_syn_cookies
>> function is active or not. the reason i think like this is that i heard
>> can't stop router being slow..
>> in this DDOS attaction problem, i suggest as NIC driver module detects
>> packet flooding, DOS attack and block or
>> ignore the packet which is sent from the attacker. we can protect out
>> network backlog safely and there will be no network soft irq ..
>> a few week later, i will try to test my idea.
>> i will use detection engine i made 3 year ago (
>> http://sourceforge.net/projects/geto )
>> as a result, i can't sure my idea is right. so i try to test that.
>> >But usually the problem is that the amount of traffic just fills
>> your entire Internet connecection, which renders it useless. The only
>> thing you can do in such a situation is ask yout ISP to block the
>> attack upstream.
>> >And often, ISPs are very unhappy about customers being DDOS-ed.
>> >-----Original Message-----
>> >From: netfilter-bounces at lists.netfilter.org
>> [mailto:netfilter-bounces at lists.netfilter.org] On Behalf Of Alberto
>> >Sent: Saturday, June 03, 2006 10:33 PM
>> >To: netfilter at lists.netfilter.org
>> >Subject: How stop DoS and SYN attack..
>> >¿any know a way to stop via Linux with iptables or related a SYN
>> attack ?
>> >¿where i can read something related to this?
>> >Thanks in advance.
>> >P.S: sorry for my bad english :D
>> >Alberto Ferrer
More information about the netfilter