0

My web host shows inbound & outbound traffic with mrtg. I have a steady 3.5mbps inbound traffic from Nigeria. Even assuming the source IPs & destination ports are blocked with Iptables & verifying nothing is listening on those ports, will the traffic still always pass through the switch & "get" to my server (where my server wastes CPU cycles "dropping" the packets)? Assuming I was setup with a hardware firewall, the traffic would still show in mrtg assuming the firewall is behind the switch?

So is there any way to stop someone from saturating your 100mbps line, if they also have a 100mbps line? Other than filing an abuse complaint with the kind folks in Nigeria?

migrated from superuser.com Oct 31 '13 at 8:16

This question came from our site for computer enthusiasts and power users.

  • 1
    Related: superuser.com/questions/593300/… – techie007 Oct 30 '13 at 18:50
  • Thanks, upvoted anyways - but I'm linux, and it also differs because this is coming from one IP, on a port I have nothing listening on (verified with netstat) – JoshRibs Oct 30 '13 at 19:04
  • Those voting to close, can you please comment & explain why this question is unwanted? My question is objective - can an upstream ISP typically block a specific IP for me? – JoshRibs Oct 30 '13 at 19:11
  • 1
    The close votes are voting to migrate it to ServerFault.com where you may have better luck. – techie007 Oct 30 '13 at 19:12
2

Software-based traffic filtering like iptables will consume CPU to drop packets, but it is negligible unless you have a really low-powered server. Drop unwanted traffic as early as possible. Use iptables rate limiting features to rate limit traffic that doesn't fall into any categories you want, if that's possible.

Server class NICs have features such as TOE and checksum offload that reduce CPU impact on received traffic.

So is there any way to stop someone from saturating your 100mbps line, if they also have a 100mbps line?

Not really. You can mitigate attacks by dropping unwanted incoming traffic, and setting up TCP tarpits, but ultimately if someone just wants to shove 100mbps of random traffic to you, and is able to, they can.

The way around this is to geographically diversify your content using a CDN or multiple IPs hosted at multiple sites. This is complex and costly, but worth looking into if you need the reliability.

1

Another solution is to bring in your ISP or whichever Service Provider is in charge of the network prior to your server.

They could have facilities like hardware firewalls to protect you from that kind of DoS attacks.

1

You yourself are at the end-point of the connection and any and all firewalling, filtering etc. you yourself can do will be on traffic that has already crossed the line to your site and is traffic which has already consumed part of your incoming bandwidth.

Many ISP's effectively only charge you for outgoing traffic so a firewall that silently discards that unwanted incoming raffic would in this case be sufficient. A software firewall on your servers is always a good idea and typically consumes negligeable resources. Alternatively use an appliance or router to firewall as well.

To prevent unwanted traffic to reach your site you'll have to take measures further upstream. Typically that will be something your telecoms provider or ISP will happily charge you for to setup and maintain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.