defending the indefensible

Recommendations

Info

IP reputation 54
Iptables to <strong>the</strong> rescue • Ipset • Supports subnets • Manual blacklisting • Hashlimits • Rate limit packets per subnet • Automatic blacklisting with timeout • Connlimit • TARPIT 55
Page 1 and 2:
Lessons from defending the indefens
Page 3 and 4: DoS is a hard problem Attacker Visi
Page 5 and 6: Congestion Network stack Slow respo
Page 7 and 8: Your Linux needs your help 7
Page 9 and 10: Congestion ! $ netstat -s! Tcp:! ..
Page 11 and 12: BGP null routing ! route 198.41.222
Page 13 and 14: High volume packet floods 13
Page 15 and 16: Looks like this Packets per second
Page 17 and 18: Drop! 17
Page 19 and 20: Packet characteristics ! • packet
Page 21 and 22: Payload matching with BPF ! iptable
Page 23 and 24: Tcpdump expressions • Originally:
Page 25 and 26: 25
Page 27 and 28: Modern NIC's RX Queue #1 Ethernet N
Page 29 and 30: Partial kernel bypas RX Queue #1 Et
Page 31 and 32: Iptables offload RX Queue #1 Ethern
Page 33 and 34: ACK floods ! IP 48.60.32.50.15244 >
Page 35 and 36: Fight for the lock CPU #1 ! Etherne
Page 37 and 38: ~1.2M pps 37
Page 39 and 40: SYN floods ! IP 94.242.250.109.4733
Page 41 and 42: SYN in Linux SYN+ACK SYN SYN backlo
Page 43 and 44: SYN backlog churn ! sysctl -w net.i
Page 45 and 46: SYN cookies ACK SYN+ACK SYN Listen
Page 47 and 48: 0.3M pps 47
Page 49 and 50: Recent changes • The idea is to r
Page 51 and 52: Real TCP/IP connections 51
Page 53: Symptoms • Connection count grows
Page 57 and 58: Note on large botnets ! GET /forum.
Page 59 and 60: Tip: sflow switch sflow switch serv
Page 61: Takeaways • You WILL null-route
show all

defending the indefensible

Create successful ePaper yourself

Delete template?

Save as template?