Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to launch and defend against a DDoS attack [pdf]

secure.edu.pl

Post reply on HN
Print view View original

11–20 of 22 posts

Re: How to launch and defend against a DDoS attack [pdf]

#11

Post by oceanplexian »

richbradshaw wrote: post #10

I have a number of websites hosted on a dedicated server running Linux. Is there any specific things that I should do on my server to mitigate/prevent any impact from a DDoS against one of the site I host?

Make sure your upstream or colo provider comes with DDoS mitigation.

Nothing within your power can protect you from a multi-gigabit DDoS attack except bandwidth or a black hole route.

If you're getting smaller attacks you can try Fail2ban, some Nginx rules, or an edge cache.

Re: How to launch and defend against a DDoS attack [pdf]

#12

Post by MichaelGG »

SIP is a particularly terrible protocol using UDP. A single SIP packet can generate significant processing, generally with IP address as the only sort of authentication. Most VoIP providers will fall over pretty quickly. The "best" implementation I've heard of is a simple L3 whitelist of known-OK IPs, but that still has the effect of killing your network to many customers. On top of that, RTP comes in dynamically on different IPs, so you need to propagate L7 info in real-time to your L3 filters. And of course, if an attacker knows who your customer is, they can just spoof their IPs.

Re: How to launch and defend against a DDoS attack [pdf]

#15

Post by kcen »

bigdubs wrote: post #5
SteveLivesInSLO wrote: post #3

Set your DNS records TTL to something relatively small like an hour. If you are hit with a DDOS and want to direct traffic through a DDOS mitigation service you will often need to point your domain at their servers. If your DNS TTL is 48 hours then you will be up a creek for quite a while.

What are the downsides of a small TTL? Why wouldn't a low TTL be default?

The primary downside to a small TTL is cost. For many DNS providers you are allotted a number of requests per month that DNS will resolve. On particularly popular websites having a ton of DNS requests can cause the cost of DNS services to inflate significantly.

Re: How to launch and defend against a DDoS attack [pdf]

#16

Post by avtar »

al1x wrote: post #14

Under "Hide Your Origin", how does one ensure that "IP only accepts packets from the [DDoS] service"?

Determine the range of addresses used by the service and then you could use hardware and/or software (iptables, pf, etc.) packet filtering to only allow packets from those hosts.

Re: How to launch and defend against a DDoS attack [pdf]

#18

Post by joshguthrie »

Martian packets are a funny thing: The packet is ALWAYS coming from somewhere, so why don't internet providers just flat out refuse to send packets exiting their networks if the given IP doesn't match what they get?

Okay, routers are supposed to get a packet and just route it to the next point by blindly following the instructions ("0.0.0.1 wants to UDP 124.40.28.9 on port 80"), but whatever the route taken, once my route leaves my home router, my first stop will ALWAYS be my provider's routers, the very company that gives me an IP.

So why can't these companies check on their client-to-outside-world routers that the request is coming from my IP and not something otherworldly?

Re: How to launch and defend against a DDoS attack [pdf]

#19

Post by elorant »

joshguthrie wrote: post #18

Martian packets are a funny thing: The packet is ALWAYS coming from somewhere, so why don't internet providers just flat out refuse to send packets exiting their networks if the given IP doesn't match what they get? Okay, routers are supposed to get a packet and just route it to the next point by blindly following the instructions ("0.0.0.1 wants to UDP 124.40.28.9 on port 80"), but whatever the route taken, once my…

And what happens if you use a VPN?

Re: How to launch and defend against a DDoS attack [pdf]

#20

Post by AsymetricCom »

elorant wrote: post #19
joshguthrie wrote: post #18

Martian packets are a funny thing: The packet is ALWAYS coming from somewhere, so why don't internet providers just flat out refuse to send packets exiting their networks if the given IP doesn't match what they get? Okay, routers are supposed to get a packet and just route it to the next point by blindly following the instructions ("0.0.0.1 wants to UDP 124.40.28.9 on port 80"), but whatever the route taken, once my…

And what happens if you use a VPN?

VPN is on another layer, the packets should still have valid IPs. 'V' stands for virtual (not Vendetta), there is no actual private network existing on top of the internet.
Post reply on HN