From: Raymond Leach <raymondl@knowledgefactory.co.za>
To: Netfilter Mailing List <netfilter@lists.netfilter.org>
Subject: Re: Interesting request. block x.x.0.0
Date: 22 Jan 2003 09:43:56 +0200 [thread overview]
Message-ID: <1043221436.1541.112.camel@rayw.knowledgefactory.co.za> (raw)
In-Reply-To: <200301220116.18451.danielf@supportteam.net>
[-- Attachment #1: Type: text/plain, Size: 2061 bytes --]
What about :
iptable -A FORWARD -s x.x.0.0/0.0.255.255 -j DROP
On Wed, 2003-01-22 at 09:16, Daniel F. Chief Security Engineer - wrote:
> Anybody know of a way to block this traffic. Notice it's comming from just the
> 0.0 addresses obviously spoofed. But can you block x.x.0.0 with out blocking
> every thing else in the range with out a rule per IP.
>
> This is s snippit of a dDoS we seen recently.
>
> 01:19:57.644845 45.208.0.0.1669 > x.x.x.x.53: S 1685323776:1685323776(0)
> 01:19:57.651441 45.210.0.0.1434 > x.x.x.x.53: S 1296957440:1296957440(0)
> 01:19:57.659812 46.79.0.0.1738 > x.x.x.x.53: S 1536360448:1536360448(0)
> 01:19:57.668782 46.82.0.0.1099 > x.x.x.x.53: S 867631104:867631104(0)
> 01:19:57.693367 46.216.0.0.1627 > x.x.x.x.53: S 1775828992:1775828992(0)
> 01:19:57.699377 47.86.0.0.1712 > x.x.x.x.53: S 543227904:543227904(0)
> 01:19:57.717765 47.222.0.0.1109 > x.x.x.x.53: S 1708457984:1708457984(0)
> 01:19:57.733676 48.93.0.0.1669 > x.x.x.x.53: S 169934848:169934848(0)
>
> I ended up just blocking tcp tp port 53 and allowed UDP through which allowed
> our name servers to work fine. TCP is rarely used on the IPs that were being
> attacked.
>
> Thanks
>
> --
> Daniel Fairchild - Chief Security Engineer | danielf@supportteam.net
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
( Raymond Leach )
) Knowledge Factory (
( )
) Tel: +27 11 445 8100 (
( Fax: +27 11 445 8101 )
) (
( http://www.knowledgefactory.co.za/ )
) http://www.saptg.co.za/ (
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
o o
o o
.--. .--.
| o_o| |o_o |
| \_:| |:_/ |
/ / \\ // \ \
( | |) (| | )
/`\_ _/'\ /'\_ _/`\
\___)=(___/ \___)=(___/
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
next prev parent reply other threads:[~2003-01-22 7:43 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-01-23 18:43 Interesting request. block x.x.0.0 Daniel F. Chief Security Engineer -
2003-01-22 7:43 ` Raymond Leach [this message]
2003-01-23 18:54 ` Ilguiz Latypov
2003-01-23 19:57 ` Daniel F. Chief Security Engineer -
-- strict thread matches above, loose matches on Subject: below --
2003-01-23 18:54 Ilguiz Latypov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1043221436.1541.112.camel@rayw.knowledgefactory.co.za \
--to=raymondl@knowledgefactory.co.za \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox