Solved

Centos DDOS TTL

Posted on 2012-03-31
7
324 Views
Last Modified: 2013-04-29
we realize that a DDos Attack always comes with same TTL so is there any script that automatically add TTLs to ip tables
0
Comment
Question by:3XLcom
  • 4
  • 2
7 Comments
 
LVL 30

Assisted Solution

by:Kerem ERSOY
Kerem ERSOY earned 334 total points
ID: 37792135
There's no way you can work the packets over TTLs. In fact as far as I understand I think that all the source addresses are fake and generated by the DDOS engine and not real addresses. They are trying to flood your bandwidth. Since TCP/IP handshake is a 3 stage process I don't think they would do handshake and establish communication properly. It means that you have your SYN packets arrive with fake address then your server responds but since there's no actual connection this connection attempts stay there and discarded by your IRC server after some time.

Generally this type of attacks are aiming to fill your bandwidth and there's so little you can do to stop that at the local level. The best thing to do should be to contact your ISP and request DDos prevention service.

Cheers,
K.
0
 

Author Comment

by:3XLcom
ID: 37792139
I am the isp and our juniper firewalls does not enough package capability to our country's bandwith standarts. We have 2*1gbps metro network but in some of countries for ex. usa or germany it is very easy to rent a server with 10 Gbps ports within 200$
we are paying more then 30k$ for 2Gbps line.
So we need to block ddos without hard limits using the lines. And juniper as i said is not enough for an atack that you described correctly and what we have issued
0
 
LVL 30

Accepted Solution

by:
Kerem ERSOY earned 334 total points
ID: 37792150
Ok then Check the other post I've suggested you some hardware :) Arbor Pravail.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:3XLcom
ID: 37792158
Arbor is very expensive solution
we have already a botnet , spam and virus protection perfectly with juniper
we just decide sth. like between juniper and cisco a centos os . or freebsd
which bridge the network transparently
if an ip get attack with same ttl
for ex.
in 1 min. 37.xx.xx.xx ip gets attack with 117 ttl more then 1k packages. so it will block the 117 ttl for an hour to this ip

this is a perfect solution for us
free and specific solution what we need :)
0
 
LVL 13

Assisted Solution

by:Sandy
Sandy earned 166 total points
ID: 37793188
But here you need to ensure the sizing part of that intermittent device and the rules processing speed. Because it is necessary  to check the CPS or PPS handling capacity of device before putting it in transparent/routed mode.
0
 

Author Comment

by:3XLcom
ID: 37793474
Think about everything is ok so then
how should we do this ?
0
 

Author Closing Comment

by:3XLcom
ID: 39120294
Sorry for late acception
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now