Solved

DDOS attack

Posted on 2014-03-04
4
62 Views
Last Modified: 2016-01-02
Hi all

The internet connectivity on my network has recently been disrupted by a DDOS attack.  My firewall logs UDP floods coming to our IP address that faces the world when we are on the net.  This then causes our internet to fail completely.  I work at a school where a lot of the students have their own devices.  Im pretty sure that the attack is being initiated from within our network maybe using a program or proxy of some sort that comes back and floods that IP from a number of different IPs.

What I want is to monitor is the network programs that are being run on devices connected to our network.  I was thinking that I could use wireshark on the network to capture all of the traffic during an attack.  What I dont know is what kinds of traffic to filter for withing wireshark.  We have spanning tree enabled on the network devices so wireshark should work just fine.

Any suggestions would be appreciated
0
Comment
Question by:gilmanschool
4 Comments
 
LVL 25

Accepted Solution

by:
Ken Boone earned 200 total points
ID: 39904313
If you are experiencing a DDOS attack coming from the outside then you might be able to figure it out.  Wireshark is going to give you so much data and its not the best at collaborating the data for this.   If you have netflow on your internet router or firewall you can pull down a program like scrutinizer and it will show you graphically who is attacking and on what ports.  You can then call your isp and see if they can filter this out on their end to free up your circuit.
0
 
LVL 25

Assisted Solution

by:madunix
madunix earned 200 total points
ID: 40072938
Check http://hakin9.org/is-ddos-still-a-threat/
I think it's wise to look at dedicated appliances such as cisco fortinet or juniper which are made to detect and defend. Try with http://www.fortinet.com/products/fortiddos/index.html
0

Featured Post

Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Using Outlook for iOS securely 2 54
google exe file 5 66
ASA5510 Blocking a Wanted Website/Host 9 25
adjusting startup config 6 24
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
February 24, 2017 — On February 23, Travis Ormandy, a vulnerability researcher at Google, reported on Twitter (https://twitter.com/taviso/status/834900838837411840) that massive stores of data have been leaked by CloudFlare, a company that provide…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question