Re: Floods

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1273 bytes --]

On Sun, Mar 14, 2004 at 07:30:29PM +0100, Micha? Margula wrote:
> Hello!
> 
> 	I have problem, quite big one. I don't know how to deal with it. Tried 
> everything i know. I have a 2 x Xeon 2.66 server with 1 Gig ram. Everything 
> based on Intel e100 and e1000 NICs. That server is my firewall and gateway.
> 
> I have common problem - viruses, worms and so on. It degrades server 
> performance quite much. I am using connlimit.
> 
> -p tcp --syn -m connlimit --connlimit-above 100 -j DROP
> 
> It was working fine until today. I was hit by UDP flood coming from one of our 
> 100mbit networks. I found that person and disconnected, but that is not 
> solution. Event "-t raw" didnt' help.
> 
> Altough after removing ip_conntrack from kernel everything goes fine. But i 
> can't stop using conntrack, because of SNAT, DNAT and REDIRECT targets.
> 
> What do you recommend? Unfortunately connlimit does not work with UDP packets 
> (no wonder - UDP is conection less). What should I do? I even thought about 
> switch to FreeBSD (sic! :<).
What about using the rate-limit module ?

> 
> Help, please!
> 
> -- 
> Micha? Margula, alchemyx@uznam.net.pl, http://alchemyx.uznam.net.pl/
> "W ?yciu pi?kne s? tylko chwile" [Ryszard Riedel]
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]