2

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network card interrupts. ksoftirqd goes to 100% and machine becomes almost unaccesible. How can I deal with these kind of attack - throwing huge number of random packets? Is there any way to somehow tweak handling server interrupts or distribute it over other CPUs?

My network card uses NAPI, linux kernel is 2.6.31.5

3
  • maybe this helps alexonlinux.com/…
    – Sandman4
    Dec 12, 2011 at 7:16
  • Thank you Sandman4. It looks promising! I will let you know if it works as soon as my hosting provider unlocks my machine :)
    – rfire
    Dec 12, 2011 at 11:26
  • yeah, google rocks
    – Sandman4
    Dec 12, 2011 at 11:32

1 Answer 1

7

You need to contact your upstream provider and have them block, filter or otherwise prevent the packets from this DDOS from reaching you. There's really not much you can do by the time they arrive on your server.

You can try to block the source IP addresses using iptables, but likely the (computational) damage is already done by the time iptables actually looks at the packets and decides to drop it.

EDIT:

Your comment doesn't make sense to me. You have DDOS caused by lots of or specially crafted packets (or both) causing too much computational overhead due to interrupt switching. Are they coming from one or a few sources? Have your upstream provider drop packets from that source/s? Profit! If they never get to your machine - they'll never cause the problem in the first place. There's no magic you can do on the host to prevent this from happening once the packets already arrive. You need to have dropped the packets before they arrive on your machine. Contact your service provider or hosting company.

8
  • The attack is one level "deeper" what i mean is i could block the whole machine to only one IP Address but it would be still inaccessible since packets comes in and generates interrupts which still consumes CPU.
    – rfire
    Dec 11, 2011 at 23:55
  • Please see my edit.
    – user62491
    Dec 11, 2011 at 23:58
  • No, unfortunately they comes from variety spoofed sources so it's impossible to block them by source IP. The packets are totally random, they only have one common thing - destination port.
    – rfire
    Dec 12, 2011 at 0:03
  • Sorry, i misunderstood your post, of course i've been talking about blocking machine to only one IP Address but on the server-level.
    – rfire
    Dec 12, 2011 at 0:12
  • I still have no idea what you're asking... what does "server-level" mean? Who controls your connection to the internet? Call them and ask them to drop traffic to your server's IP address and the specific destination port (provided that that port isn't used for other services you need).
    – user62491
    Dec 12, 2011 at 1:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .