From: "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu>
To: netfilter@vger.kernel.org
Subject: Re: iptables based appliances
Date: Sun, 7 Jun 2015 15:51:20 -0400 [thread overview]
Message-ID: <20150607155120.43e0eab8@playground> (raw)
In-Reply-To: <201506071504.t57F4fuH020015@Mail.Linux-Consulting.com>
On Sun, 7 Jun 2015 08:04:40 -0700 (PDT)
alvin <alvin.sm@Mail.Linux-Consulting.com> wrote:
>
> hi netfilter ml
>
> i was curious,
>
> does anybody know which ddos appliances uses IPtables to
> mitigate incoming ddos attacks ?
>
> ----
>
> in the past few years, i've tarpit'd about 10,000 IP# of DDoS
> attackers on a little ole box ( EPIA-800 w/ 1GB of memory ) and it
> barely can handle the load ... but than again, 10,000 iptables
> entries is fairly steep and semi-ridiculous :-)
>
> http://networknightmare.net/Tarpits/#Install
>
> even if the src IP# might be spoof'd, you, i still do NOT want those
> incoming DDoS attacks coming in at 1,000 or 10,000 packets per second
Yes, 1000 rules is a little overboard.
Have you tried ipset? Last I knew, it becomes more efficient than
individual rules when there are more than 16 IPs to check.
N
next prev parent reply other threads:[~2015-06-07 19:51 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-07 15:04 iptables based appliances alvin
2015-06-07 19:51 ` Neal P. Murphy [this message]
2015-06-08 14:02 ` iptables based appliances - ipset alvin
2015-06-08 16:02 ` Neal P. Murphy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150607155120.43e0eab8@playground \
--to=neal.p.murphy@alum.wpi.edu \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.