Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Centos DDOS TTL

Posted on 2012-03-31
7
Medium Priority
?
344 Views
Last Modified: 2013-04-29
we realize that a DDos Attack always comes with same TTL so is there any script that automatically add TTLs to ip tables
0
Comment
Question by:3XLcom
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 30

Assisted Solution

by:Kerem ERSOY
Kerem ERSOY earned 1002 total points
ID: 37792135
There's no way you can work the packets over TTLs. In fact as far as I understand I think that all the source addresses are fake and generated by the DDOS engine and not real addresses. They are trying to flood your bandwidth. Since TCP/IP handshake is a 3 stage process I don't think they would do handshake and establish communication properly. It means that you have your SYN packets arrive with fake address then your server responds but since there's no actual connection this connection attempts stay there and discarded by your IRC server after some time.

Generally this type of attacks are aiming to fill your bandwidth and there's so little you can do to stop that at the local level. The best thing to do should be to contact your ISP and request DDos prevention service.

Cheers,
K.
0
 

Author Comment

by:3XLcom
ID: 37792139
I am the isp and our juniper firewalls does not enough package capability to our country's bandwith standarts. We have 2*1gbps metro network but in some of countries for ex. usa or germany it is very easy to rent a server with 10 Gbps ports within 200$
we are paying more then 30k$ for 2Gbps line.
So we need to block ddos without hard limits using the lines. And juniper as i said is not enough for an atack that you described correctly and what we have issued
0
 
LVL 30

Accepted Solution

by:
Kerem ERSOY earned 1002 total points
ID: 37792150
Ok then Check the other post I've suggested you some hardware :) Arbor Pravail.
0
Q2 2017 - Latest Malware & Internet Attacks

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out our latest Quarterly Internet Security Report!

 

Author Comment

by:3XLcom
ID: 37792158
Arbor is very expensive solution
we have already a botnet , spam and virus protection perfectly with juniper
we just decide sth. like between juniper and cisco a centos os . or freebsd
which bridge the network transparently
if an ip get attack with same ttl
for ex.
in 1 min. 37.xx.xx.xx ip gets attack with 117 ttl more then 1k packages. so it will block the 117 ttl for an hour to this ip

this is a perfect solution for us
free and specific solution what we need :)
0
 
LVL 13

Assisted Solution

by:Sandy
Sandy earned 498 total points
ID: 37793188
But here you need to ensure the sizing part of that intermittent device and the rules processing speed. Because it is necessary  to check the CPS or PPS handling capacity of device before putting it in transparent/routed mode.
0
 

Author Comment

by:3XLcom
ID: 37793474
Think about everything is ok so then
how should we do this ?
0
 

Author Closing Comment

by:3XLcom
ID: 39120294
Sorry for late acception
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Suggested Courses

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question