StealthNet
   |
Posted - 2003.08.29 19:02:00 -
[1]
Edited by: StealthNet on 29/08/2003 19:13:53
There are no ways to defeat a good DDoS attack (we are not talking here about a DoS). You can soften the results, try to make a workaround, with backup backbones. But once you have limited bandwidth, you are subject to attacks.
You can filter out packets. Yes, you can, but the only way to defeat it is to filter out every single tcp and udp port (guess what: your service will be filtered out too).
Once you have at least 1 port for a connection, you have everything you need for a DDoS. That port may run flawless, but DDoS are simple bandwidth issues.
Some recomendations I would like to make to CCP guys:
1. ask your backbone provider (Cable & Wireless) to filter out EVERY following packet in or out 166.62.210.0 (it appears to be the source of the problems, but I don't know how this network is subneted):
ICMP packet IN and OUT
UDP packet IN and OUT
TCP packet IN and OUT EXCEPT the ports used by EVE
2. if your border gateway (router) is configured to filter packets, thats a no-no. You are prolly running out of mem and cpu. Buy a specialized hardware for that work or leave it to Cable and Wireless. Ask them to solve their problems because leaving the router at 166.63.210.62 and .61 changing routes every time they find the traffic is heavy will bring more problems than solving (every route change brings a hickup ingame - and one is happening every 30 seconds).
3. depending on the operating system used by the proxies, configure their TCPIP stack to be less polite with half open connections. If you are using a layer4 switching with forwarding, than config that equipment to drop from the table as quickly as possible half-open connections. Windows 2000, Linux, UNIX, almost every OS out there has a tcpip option to be more agressive regarding to syn attacks.
4. basic homework: make sure everything that has a tcpip stack in your network is configured to NOT allow source routing, router discovery, blackhole discovery, etc. Use static routes as much as possible to take some load out. Also (I suppose you have firewalls), config the fws to *drop* packets instead of refusing them; config them to drop strange source and destination address sets (example: inbound traffic with source address inside your network, with lookback or multicast addresses). Same thing for outbound packets (drop packets with source address different from your internal network).
I suppose you guys already did everything in this list right ? because atm, I'm getting 60% packet loss.
_______________________________________________
|