1

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. Nothing more. Now I am thinking about a (D)DoS-attack that most likely will hit my IP one day.

To block this attack is one thing, but I want to provide best uptime for my blockchain-client as possible. So I am thinking about two options: Switching off the attacked server and turn on a backup server NOR buying some more IPs for my server and just switch the IP.

It would be cheaper if the "IP-switch" would work in this scenario, than to rent one or two backup servers. But I never did this and have never faced (D)DoS, so my experience level is very low.

What's your opinion? Would the "IP-switch" work?

Edit

Addtional thoughts: Will attackers attack an IP itself or are they attacking the IP:PORT? So, the question is, might it be possible just to change the port of the blockchain-client and close the attacked port? Or can an attacker do (D)DoS also on any other open port, like SSH (if the attacker does a portscan and finds the correct SSH port)?

  • Won't they rapidly find the new IP? – ceejayoz Mar 30 '16 at 21:52
  • No. Well, not without some research. There is a blockhain explorer which shows all servers. From there they can pick up all 101 IPs, but they don't know who is which IP. So, they would have to compare their attack-list with the list on the blockchain explorer again and again to make sure their attack list is up to date. It's possible they will do this. Maybe they will do this automatically, but the hurdle is higher for them. – John Doof Mar 31 '16 at 0:59
  • ...and they actually would have to attack all 101 IPs at once to make sure mine is in the list. But for the case they just pick 5 of 101 and I am one of their victims, it would be even harder to find my new IP again. – John Doof Mar 31 '16 at 1:18
  • Automating that and hitting all 101 IPs would be trivial for an average attacker. – ceejayoz Mar 31 '16 at 3:09
  • Well, the attacker has to rescan the 101 IPs again and re-point his attack. Any further suggestions? – John Doof Mar 31 '16 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.