1

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. Nothing more. Now I am thinking about a (D)DoS-attack that most likely will hit my IP one day.

To block this attack is one thing, but I want to provide best uptime for my blockchain-client as possible. So I am thinking about two options: Switching off the attacked server and turn on a backup server NOR buying some more IPs for my server and just switch the IP.

It would be cheaper if the "IP-switch" would work in this scenario, than to rent one or two backup servers. But I never did this and have never faced (D)DoS, so my experience level is very low.

What's your opinion? Would the "IP-switch" work?

Edit

Addtional thoughts: Will attackers attack an IP itself or are they attacking the IP:PORT? So, the question is, might it be possible just to change the port of the blockchain-client and close the attacked port? Or can an attacker do (D)DoS also on any other open port, like SSH (if the attacker does a portscan and finds the correct SSH port)?

Improve this question
5
  • Won't they rapidly find the new IP?
    – ceejayoz
    Mar 30, 2016 at 21:52
  • No. Well, not without some research. There is a blockhain explorer which shows all servers. From there they can pick up all 101 IPs, but they don't know who is which IP. So, they would have to compare their attack-list with the list on the blockchain explorer again and again to make sure their attack list is up to date. It's possible they will do this. Maybe they will do this automatically, but the hurdle is higher for them.
    – John Doof
    Mar 31, 2016 at 0:59
  • ...and they actually would have to attack all 101 IPs at once to make sure mine is in the list. But for the case they just pick 5 of 101 and I am one of their victims, it would be even harder to find my new IP again.
    – John Doof
    Mar 31, 2016 at 1:18
  • Automating that and hitting all 101 IPs would be trivial for an average attacker.
    – ceejayoz
    Mar 31, 2016 at 3:09
  • Well, the attacker has to rescan the 101 IPs again and re-point his attack. Any further suggestions?
    – John Doof
    Mar 31, 2016 at 9:42

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .