Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Centos DDOS TTL

Posted on 2012-03-31
7
329 Views
Last Modified: 2013-04-29
we realize that a DDos Attack always comes with same TTL so is there any script that automatically add TTLs to ip tables
0
Comment
Question by:3XLcom
  • 4
  • 2
7 Comments
 
LVL 30

Assisted Solution

by:Kerem ERSOY
Kerem ERSOY earned 334 total points
ID: 37792135
There's no way you can work the packets over TTLs. In fact as far as I understand I think that all the source addresses are fake and generated by the DDOS engine and not real addresses. They are trying to flood your bandwidth. Since TCP/IP handshake is a 3 stage process I don't think they would do handshake and establish communication properly. It means that you have your SYN packets arrive with fake address then your server responds but since there's no actual connection this connection attempts stay there and discarded by your IRC server after some time.

Generally this type of attacks are aiming to fill your bandwidth and there's so little you can do to stop that at the local level. The best thing to do should be to contact your ISP and request DDos prevention service.

Cheers,
K.
0
 

Author Comment

by:3XLcom
ID: 37792139
I am the isp and our juniper firewalls does not enough package capability to our country's bandwith standarts. We have 2*1gbps metro network but in some of countries for ex. usa or germany it is very easy to rent a server with 10 Gbps ports within 200$
we are paying more then 30k$ for 2Gbps line.
So we need to block ddos without hard limits using the lines. And juniper as i said is not enough for an atack that you described correctly and what we have issued
0
 
LVL 30

Accepted Solution

by:
Kerem ERSOY earned 334 total points
ID: 37792150
Ok then Check the other post I've suggested you some hardware :) Arbor Pravail.
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 

Author Comment

by:3XLcom
ID: 37792158
Arbor is very expensive solution
we have already a botnet , spam and virus protection perfectly with juniper
we just decide sth. like between juniper and cisco a centos os . or freebsd
which bridge the network transparently
if an ip get attack with same ttl
for ex.
in 1 min. 37.xx.xx.xx ip gets attack with 117 ttl more then 1k packages. so it will block the 117 ttl for an hour to this ip

this is a perfect solution for us
free and specific solution what we need :)
0
 
LVL 13

Assisted Solution

by:Sandy
Sandy earned 166 total points
ID: 37793188
But here you need to ensure the sizing part of that intermittent device and the rules processing speed. Because it is necessary  to check the CPS or PPS handling capacity of device before putting it in transparent/routed mode.
0
 

Author Comment

by:3XLcom
ID: 37793474
Think about everything is ok so then
how should we do this ?
0
 

Author Closing Comment

by:3XLcom
ID: 39120294
Sorry for late acception
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
The purpose of this article is to demonstrate how we can upgrade Python from version 2.7.6 to Python 2.7.10 on the Linux Mint operating system. I am using an Oracle Virtual Box where I have installed Linux Mint operating system version 17.2. Once yo…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question