defending the indefensible

Recommendations

Info

Effective • Works well against: • ACK • FIN • RST • X-mas • What about SYN floods? 38
SYN floods ! IP 94.242.250.109.47330 > 1.2.3.4:80: Flags [S], seq 1444613291, win 63243! IP 188.138.1.240.61454 > 1.2.3.4:80: Flags [S], seq 1995637287, win 60551! IP 207.244.90.205.17572 > 1.2.3.4:80: Flags [S], seq 1523683071, win 61607! IP 94.242.250.224.65127 > 1.2.3.4:80: Flags [S], seq 928944042, win 61778! IP 207.244.90.205.43074 > 1.2.3.4:80: Flags [S], seq 137074667, win 63891! IP 64.22.81.44.23865 > 1.2.3.4:80: Flags [S], seq 838596928, win 63808,! IP 188.138.1.137.23373 > 1.2.3.4:80: Flags [S], seq 593106072, win 60272! IP 207.244.90.205.39653 > 1.2.3.4:80: Flags [S], seq 47289666, win 63210! IP 208.66.78.204.64197 > 1.2.3.4:80: Flags [S], seq 1850809890, win 62714! IP 207.244.90.205.33108 > 1.2.3.4:80: Flags [S], seq 319707959, win 63351! IP 207.244.90.205.6937 > 1.2.3.4:80: Flags [S], seq 1591500126, win 63902! IP 213.152.180.151.60560 > 1.2.3.4:80: Flags [S], seq 1902119375, win 62511! IP 64.22.79.127.11061 > 1.2.3.4:80: Flags [S], seq 1456438676, win 62148! 39
Page 1 and 2: Lessons from defending the indefens
Page 3 and 4: DoS is a hard problem Attacker Visi
Page 5 and 6: Congestion Network stack Slow respo
Page 7 and 8: Your Linux needs your help 7
Page 9 and 10: Congestion ! $ netstat -s! Tcp:! ..
Page 11 and 12: BGP null routing ! route 198.41.222
Page 13 and 14: High volume packet floods 13
Page 15 and 16: Looks like this Packets per second
Page 17 and 18: Drop! 17
Page 19 and 20: Packet characteristics ! • packet
Page 21 and 22: Payload matching with BPF ! iptable
Page 23 and 24: Tcpdump expressions • Originally:
Page 25 and 26: 25
Page 27 and 28: Modern NIC's RX Queue #1 Ethernet N
Page 29 and 30: Partial kernel bypas RX Queue #1 Et
Page 31 and 32: Iptables offload RX Queue #1 Ethern
Page 33 and 34: ACK floods ! IP 48.60.32.50.15244 >
Page 35 and 36: Fight for the lock CPU #1 ! Etherne
Page 37: ~1.2M pps 37
Page 41 and 42: SYN in Linux SYN+ACK SYN SYN backlo
Page 43 and 44: SYN backlog churn ! sysctl -w net.i
Page 45 and 46: SYN cookies ACK SYN+ACK SYN Listen
Page 47 and 48: 0.3M pps 47
Page 49 and 50: Recent changes • The idea is to r
Page 51 and 52: Real TCP/IP connections 51
Page 53 and 54: Symptoms • Connection count grows
Page 55 and 56: Iptables to the rescue • Ipset
Page 57 and 58: Note on large botnets ! GET /forum.
Page 59 and 60: Tip: sflow switch sflow switch serv
Page 61: Takeaways • You WILL null-route

defending the indefensible

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?