Solved

Centos DDOS TTL

Posted on 2012-03-31
7
327 Views
Last Modified: 2013-04-29
we realize that a DDos Attack always comes with same TTL so is there any script that automatically add TTLs to ip tables
0
Comment
Question by:3XLcom
  • 4
  • 2
7 Comments
 
LVL 30

Assisted Solution

by:Kerem ERSOY
Kerem ERSOY earned 334 total points
ID: 37792135
There's no way you can work the packets over TTLs. In fact as far as I understand I think that all the source addresses are fake and generated by the DDOS engine and not real addresses. They are trying to flood your bandwidth. Since TCP/IP handshake is a 3 stage process I don't think they would do handshake and establish communication properly. It means that you have your SYN packets arrive with fake address then your server responds but since there's no actual connection this connection attempts stay there and discarded by your IRC server after some time.

Generally this type of attacks are aiming to fill your bandwidth and there's so little you can do to stop that at the local level. The best thing to do should be to contact your ISP and request DDos prevention service.

Cheers,
K.
0
 

Author Comment

by:3XLcom
ID: 37792139
I am the isp and our juniper firewalls does not enough package capability to our country's bandwith standarts. We have 2*1gbps metro network but in some of countries for ex. usa or germany it is very easy to rent a server with 10 Gbps ports within 200$
we are paying more then 30k$ for 2Gbps line.
So we need to block ddos without hard limits using the lines. And juniper as i said is not enough for an atack that you described correctly and what we have issued
0
 
LVL 30

Accepted Solution

by:
Kerem ERSOY earned 334 total points
ID: 37792150
Ok then Check the other post I've suggested you some hardware :) Arbor Pravail.
0
Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

 

Author Comment

by:3XLcom
ID: 37792158
Arbor is very expensive solution
we have already a botnet , spam and virus protection perfectly with juniper
we just decide sth. like between juniper and cisco a centos os . or freebsd
which bridge the network transparently
if an ip get attack with same ttl
for ex.
in 1 min. 37.xx.xx.xx ip gets attack with 117 ttl more then 1k packages. so it will block the 117 ttl for an hour to this ip

this is a perfect solution for us
free and specific solution what we need :)
0
 
LVL 13

Assisted Solution

by:Sandy
Sandy earned 166 total points
ID: 37793188
But here you need to ensure the sizing part of that intermittent device and the rules processing speed. Because it is necessary  to check the CPS or PPS handling capacity of device before putting it in transparent/routed mode.
0
 

Author Comment

by:3XLcom
ID: 37793474
Think about everything is ok so then
how should we do this ?
0
 

Author Closing Comment

by:3XLcom
ID: 39120294
Sorry for late acception
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now