Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks.

Do not discuss using 3rd party software, this is a place to make your own ideas and read others.

Post examples if you'd like. Post ideas how to filter out flood attacks. Post ideas how to keep your server alive while being under a heavy DDoS attack.

share|improve this question
1  
Welcome to SF! This should be marked Community Wiki. You can edit the question and check the box right underneath the body of the question. –  squillman Jan 6 '10 at 2:20
add comment

4 Answers

During a DDOS SYN attack, I moved my site to a 2nd IP and had my ISP block the original IP at their level. While this did create a bit of downtime as a result of DNS propagation, it did relieve the load and get me back online. Blocking the original IP at the ISP level kept the DDOS from reaching my servers. A secondary DDOS attack was then launched made up of legit connections, but lots of them. I ended up patching my Linux firewall's iptables to use ipset for better performance as I blocked the thousands of IPs.

After the attack I tested various firewalls (sorry, no Cisco). PF with it's synproxy flag from the BSD family gave the best results. Unlike most firewalls that just kicked in rate limiting during an attack, pf with it's synproxy stopped a lot of the connections at the firewall. Also, pf's tables have great look up performance and are dynamically updatable. No reload required. pf also has a lot of options for tuning performance and scrubbing incoming packets/connections.

netfilter with ipset gave good performance, but no synproxy.

Another possibility is to use cloud based hosting, allowing you to keep throwing more bandwidth and hardware at the attack so your clients don't feel the attack.

The only way to truly prevent a DDOS is to keep your server(s) off the internet. But then you have to explain to management why no one can see your company's website. :-)

share|improve this answer
    
+1 for mentioning PF with Synproxy. –  Maxwell Jan 6 '10 at 8:05
add comment

There are a lot of different types of Denial of Service (DoS) attacks and no single solution can solve this problem. Web Application Firewalls (WAF) can be used to protect servers from the flood of traffic produced by a Distributed Denial (DDoS) of Service attack. Often these attacks contain a large volume of the same type of request. A WAF can rate limit or even block a specific user that sends a large number of http requests. A ICMP ping is another common DDoS type, if you block incoming ICMP with your packet filtering firewall then this will mitigate the attack.

But eventually with enough traffic the infrastrucutre around you will began to crumble and your server will go down. Routers for the backbone of the internet have become clogged by DDoS attacks produced by worms. Recently, UltraDNS was DDoS'ed which caused Amazon.com to go down: http://www.securityfocus.com/brief/1053

Finley, it doesn't take a massive number of packets to take down a server. A Denial of Service attack can be as small only 1 malformed packet. A buffer overflow can cause the server to crash, or even worse, give full access of your server to a hacker. Make sure your software is up to date.

share|improve this answer
add comment

There are companies which specialise in this sort of service. They have huge bandwidth available so that they can take a hit and only filter out legitimate requests to your servers.

Update: If you really want to try to do it yourself then first of all consider the fact that there were attacks with 50-80Gbit/sec sustained bandwidth. And each year it only gets bigger and bigger. I won't be surprised to see 100+ attacks this year.

Now regarding defence:

  1. Any attacks below application layer have to be stopped at the perimeter (better - at the ISP border). Invest in good firewalls - CPU load will be huge, so the more powerful - the better.
  2. Before your application is under attack - try to think as an attacker - what are the weakest parts? Attacker will be hitting pages that require only a few bytes to be uploaded to your servers but that perform a lot of heavy lifting on the server side (e.g. any sorts of searches with wildcards etc). Pages accessible without authentication should be reviewed first. Try to come with a solution that will allow you to quickly turn this functionality off without switching the whole site off.

  3. Some attacks originate from specific countries only (e.g. China, Russia, Korea(s) ). You can prepare ACLs for your routers that will block all netblocks that belong to a specific country. But be careful, under a massive attack chances are that your firewalls will be striggling with the CPU load.

Good luck!

share|improve this answer
    
No why don't you actually read the entire post before replying. "Do not discuss using 3rd party software" –  Gnarly Jan 6 '10 at 21:12
1  
This is not 3rd party software. This is just not implementing it yourself and to allow another company to do it for you. My point is that they have bandwidth/technology that will be infeasible for any individual company to have. –  DmitryK Jan 7 '10 at 11:49
    
And that falls under 3rd party software. (imo) Because of the fact that they are not YOU, and they wont stop an attack, it only "sucks in the attacks". –  Gnarly Jan 7 '10 at 22:48
add comment

mod_evasive is one of the best server side contra measures that you can take, if you are running an Apache web server - http://www.think-security.com/protect-your-apache-web-server-with-mod_evasive/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.