Solved

DDoS Protection services

Posted on 2014-04-07
4
343 Views
Last Modified: 2014-04-09
Hi,

We have suffered a couple of serious Syn Flood attacks recently.  We thought we had put the right levels of protection on our server, but we are now seriously considering using a web based service (see list below).

What should we look out for with these services?

What should we expect to pay for the services?

Does anyone have any particular recommendations?

cloudflare.com
dosarrest.com
rivalhost.com
prolexic.com
incapsula.com

Many thanks
chris
0
Comment
Question by:Chris_Ryan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39983166
hardware based firewall, it is probably being logged. I suggest reviewing those logs. I also suggest having those logs sent to a system admin by email as the log fills up so they can be reviewed anytime. Without sending those logs, the old logged events get  over written as new logs are created.

We use a Sonicwall firewall for this. It works very well. Cisco and other brands should work well also.

You might also try contacting your ISP, although most of the time, adding a firewall is the best first step.

Hope this helps.
0
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39983728
How many users are in you protecting? What do you have in place currently?
0
 

Author Comment

by:Chris_Ryan
ID: 39983878
Hi Diverseit

We have six major domains and hundreds of sub-domains.

We have CSF in place with iptables

Thanks
Chris
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 39987157
You have to work with the ISP's to mitigate some of these large DDOS attacks, you can't do it yourself with hardware. If the pipe fills up, your RST packet's can't get through, and if they are redirected+amplified, you may cause harm to other networks. CloudFlare and others work with the ISP's, they don't have any magic other than that:
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
You can't mitigate todays attacks of this magnitude without a special service, hardware doesn't cut it anymore.
-rich
0

Featured Post

How To Reduce Deployment Times With Pre-Baked AMIs

Even if we can't include all the files in the base image, we can sometimes include some of the larger files that we would otherwise have to download, and we can also sometimes remove the most time-consuming steps. This can help a lot with reducing deployment times.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
The recent Petya-like ransomware attack served a big blow to hundreds of banks, corporations and government offices The Acronis blog takes a closer look at this damaging worm to see what’s behind it – and offers up tips on how you can safeguard your…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question