From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeho Park Subject: Re: How stop DoS and SYN attack.. Date: Tue, 06 Jun 2006 23:55:08 +0900 Message-ID: <4485974C.3060500@kernelproject.org> References: <02BB8A4AC86C564C89C7F14CF98CE0C49C72@knowledge.wizdom.nu> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <02BB8A4AC86C564C89C7F14CF98CE0C49C72@knowledge.wizdom.nu> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: Sietse van Zanen Cc: netfilter@lists.netfilter.org Sietse van Zanen wrote: >There's not really very much you can do about DDOS attacks with netfilte= r alone. You can block the traffic ofcourse, or try to fiddle with --limi= t, or tcp_syn_cookies. > =20 > i think as a attacker try to send more and more sync packets, router=20 will lose cpu time and system resource .. even if tcp_syn_cookies=20 function is active or not. the reason i think like this is that i heard=20 tcp_syn_cookies can't stop router being slow.. in this DDOS attaction problem, i suggest as NIC driver module detects=20 packet flooding, DOS attack and block or ignore the packet which is sent from the attacker. we can protect out=20 network backlog safely and there will be no network soft irq ..=20 a few week later, i will try to test my idea. i will use detection engine i made 3 year ago (=20 http://sourceforge.net/projects/geto ) as a result, i can't sure my idea is right. so i try to test that. >But usually the problem is that the amount of traffic just fills your en= tire Internet connecection, which renders it useless. The only thing you = can do in such a situation is ask yout ISP to block the attack upstream. >And often, ISPs are very unhappy about customers being DDOS-ed. > >-Sietse=20 > >-----Original Message----- >From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-bounces@li= sts.netfilter.org] On Behalf Of Alberto Ferrer >Sent: Saturday, June 03, 2006 10:33 PM >To: netfilter@lists.netfilter.org >Subject: How stop DoS and SYN attack.. > >=BFany know a way to stop via Linux with iptables or related a SYN attac= k ? >=BFwhere i can read something related to this? > >Thanks in advance. > >P.S: sorry for my bad english :D >-- >Alberto Ferrer > > > > > =20 >