All of lore.kernel.org
 help / color / mirror / Atom feed
From: Gordan Bobic <lartc@bobich.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Need help please
Date: Thu, 20 Mar 2003 12:42:30 +0000	[thread overview]
Message-ID: <marc-lartc-104816440303083@msgid-missing> (raw)

On Thursday 20 Mar 2003 12:49, Webadmin wrote:

> We've been getting some DDOS attack recently, due to this I was just
> wondering if we use some network traffic control techniques in order to
> reduce the risk of having the DDOS attack?? is this possible after all??
> can we use the traffic control techniques in order to redu reduce the DDOS
> attack???

I don't think you can reduce the "risk" of being under attack.

What sort of an attack are you under? Ping/ICMP flood? Or just a lot of robots 
killing your web server with seemingly valid requests?

If you are having your bandwidth between your router and your ISPs all used up 
by the attack, then you may be out of luck, as congestion and dropping will 
most likely occur before any valid traffic gets through to you.

OTOH, if it is just your server load that is being affected, then yes, you 
could potentially do something about it, provided you have some bandwidth to 
spare. You could block or reduce the priority of the offending traffic. You 
could also analyze logs what hosts are consuming a large amount of resources, 
or analyze the headers they are sending, and try to separate valid traffic by 
that. Then, just drop all traffic to/from the offending hosts completely, or 
reduce their traffic to a minimum priority. You can do this using 
ipchains/iptables and setting fwmarks on packets to/from relevant machines, 
and then filtering on fwmarks.

Ideally, you might be able to ask your ISP to filter out the offending traffic 
before it hits your local router, so it doesn't consume your bandwidth, but 
that depends on what they are able/willing to do with their network setup to 
help you out...

I think you will have to be a little more specific about the type of attack 
you are under for any more specific suggestions...

Regards.

Gordan
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

             reply	other threads:[~2003-03-20 12:42 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-03-20 12:42 Gordan Bobic [this message]
2003-03-20 12:49 ` [LARTC] Need help please Webadmin
2003-03-20 13:04 ` Emmanuel Guiton
2003-03-21  5:14 ` S Mohan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-104816440303083@msgid-missing \
    --to=lartc@bobich.net \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.