2

Newroz Telecom (an ISP) is using an exit node (or gateway) for each city they operate in. That is all the users in city A is sharing one public IP (when the users go to a website to show their IP they all get the same result).

I am having DDOS attacks that is coming from a user/users of this ISP, blocking the IP will mean blocking the entire city, how can i fight DDOS in such environment ?

Best regards,

Improve this question
1
  • Signing up for CloudFlare (or a similar service) might be a good option for you.
    – Ladadadada
    Jul 4, 2013 at 18:30

1 Answer 1

Reset to default
1

Here are a few options:

Can you TCPDump the traffic and maybe find a packet that is the ddos packet string and block it?

In all honesty, the only way this will probably be fixable is to ask the ISP to check and find the abuser.

Improve this answer
4
  • The attack have stopped (for now) and i am out of the office so i cant run your request at the moment, but can you explain more about blocking the packet string ? What do you mean ? Wont that be just like blocking the public ip ? Or do you mean check the packets and drop the malicious ones ?
    – zertux
    Jul 4, 2013 at 16:52
  • Packets contain TTL, Strings, and other information. You can use IPTables to block certain packets based on certain contents. This can work in situations the attackers packets are the same.
    – Tiffany Walker
    Jul 4, 2013 at 20:57
  • I see, do you reommend any readings on this ? Books, tutorials ?
    – zertux
    Jul 4, 2013 at 22:01
  • I would man TCPDump and look up TCPDump.
    – Tiffany Walker
    Jul 4, 2013 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .