From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: netfilter@vger.kernel.org
Subject: Re: Denial-of-Service attack on UDP-port 5060 (SIP/VoIP)
Date: Sun, 28 Nov 2010 19:59:18 +0100 [thread overview]
Message-ID: <4CF2A686.4000309@plouf.fr.eu.org> (raw)
In-Reply-To: <C426DC428D95484BB7DF53F6DA1B34DB@gericomfx5600>
Hello,
Secure-SIP-Server a écrit :
>
> I'm suffering on a Denial-of-Service attack on my SIP(VoIP) UDP port 5060,
> getting more then 70 REGISTER requests per second since yesterday. All
> comming from the Japanese IP 59.146.75.111:5088.
[...]
> Now my 2nd question:
> How can this requests (UDP) be from a ESTABLISHED connection??? They passed
> the firewall in the first two examples and therefore they must be
> ESTABLISHED!?!
UDP being connectionless by nature, the notion of "UDP connection" is
rather loose. Therefore a continuous flow of packets with the same ports
and addresses can be considered as one sigle connection even if they are
actually unrelated requests.
> 3rd question:
> Is there a way to tell iptables to lock only a specific IP:PORT for a while
> if this IP transmits more then 50 requests per second? If so, how?
Check the "recent" match. Be sure you read carefully the man page about
its default limits.
next prev parent reply other threads:[~2010-11-28 18:59 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-28 16:02 Denial-of-Service attack on UDP-port 5060 (SIP/VoIP) Secure-SIP-Server
2010-11-28 18:59 ` Pascal Hambourg [this message]
2010-11-28 21:31 ` Secure-SIP-Server
2010-11-29 1:20 ` SISINT BA
2010-11-29 2:50 ` /dev/rob0
2010-11-29 13:12 ` SISINT BA
2010-11-29 21:38 ` Secure-SIP-Server
2010-12-01 15:48 ` /dev/rob0
2010-12-01 18:31 ` Secure-SIP-Server
2010-11-30 13:14 ` Using iptables for throttling SMTP traffic Secure-SIP-Server
2010-11-30 13:24 ` Jan Engelhardt
2010-11-30 14:01 ` lst_hoe02
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CF2A686.4000309@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.