Solved

Centos DDOS TTL

Posted on 2012-03-31
7
332 Views
Last Modified: 2013-04-29
we realize that a DDos Attack always comes with same TTL so is there any script that automatically add TTLs to ip tables
0
Comment
Question by:3XLcom
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 30

Assisted Solution

by:Kerem ERSOY
Kerem ERSOY earned 334 total points
ID: 37792135
There's no way you can work the packets over TTLs. In fact as far as I understand I think that all the source addresses are fake and generated by the DDOS engine and not real addresses. They are trying to flood your bandwidth. Since TCP/IP handshake is a 3 stage process I don't think they would do handshake and establish communication properly. It means that you have your SYN packets arrive with fake address then your server responds but since there's no actual connection this connection attempts stay there and discarded by your IRC server after some time.

Generally this type of attacks are aiming to fill your bandwidth and there's so little you can do to stop that at the local level. The best thing to do should be to contact your ISP and request DDos prevention service.

Cheers,
K.
0
 

Author Comment

by:3XLcom
ID: 37792139
I am the isp and our juniper firewalls does not enough package capability to our country's bandwith standarts. We have 2*1gbps metro network but in some of countries for ex. usa or germany it is very easy to rent a server with 10 Gbps ports within 200$
we are paying more then 30k$ for 2Gbps line.
So we need to block ddos without hard limits using the lines. And juniper as i said is not enough for an atack that you described correctly and what we have issued
0
 
LVL 30

Accepted Solution

by:
Kerem ERSOY earned 334 total points
ID: 37792150
Ok then Check the other post I've suggested you some hardware :) Arbor Pravail.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:3XLcom
ID: 37792158
Arbor is very expensive solution
we have already a botnet , spam and virus protection perfectly with juniper
we just decide sth. like between juniper and cisco a centos os . or freebsd
which bridge the network transparently
if an ip get attack with same ttl
for ex.
in 1 min. 37.xx.xx.xx ip gets attack with 117 ttl more then 1k packages. so it will block the 117 ttl for an hour to this ip

this is a perfect solution for us
free and specific solution what we need :)
0
 
LVL 13

Assisted Solution

by:Sandy
Sandy earned 166 total points
ID: 37793188
But here you need to ensure the sizing part of that intermittent device and the rules processing speed. Because it is necessary  to check the CPS or PPS handling capacity of device before putting it in transparent/routed mode.
0
 

Author Comment

by:3XLcom
ID: 37793474
Think about everything is ok so then
how should we do this ?
0
 

Author Closing Comment

by:3XLcom
ID: 39120294
Sorry for late acception
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Post Clonezilla image restore issue 6 88
Linux MD5 Hash 7 96
sed replace command 12 27
need a help to fix one if else shell script issue 6 31
Have you ever been frustrated by having to click seven times in order to retrieve a small bit of information from the web, always the same seven clicks, scrolling down and down until you reach your target? When you know the benefits of the command l…
I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Suggested Courses

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question