4 ms·
QoS can help with DDoS if the DDoS is L7, but most DDoS attacks are bandwidth exhaustion attacks, which requires upstream mitigation. I completely agree that "
by bcook 11y ago
QoS can help with DDoS if the DDoS is L7, but most DDoS attacks are bandwidth exhaustion attacks, which requires upstream mitigation.
I completely agree that "tc" is one of the most confusing CLI programs I have encountered. tc & iptables pushed me away from Linux (for router purposes) to *BSD and pf has been a refreshing experience.
- ktsaou 11y agoYour are so right! However most of the DDoS attacks I have experienced were amateur, L7 (wordpress, POSTs, etc).
- jrcii 11y agoI've really enjoyed pf on OpenBSD over the years. My only frustration has been the ever-changing backwards-incompatible rule syntax which perpetually makes large swaths of documentation useless, including the most recent printed book on pf and numerous online sources.
- geggam 11y agoman pf.conf .. always works :)
- txutxu 11y agoCome on, it's not so hard. You mark the packages in the mangle table and you distribute the defined bw with tc. OK, I confess... all my life I've reused a tc script I inherited from a gentoo sysadmin. It works, I edit the available bandwitch and magic happens. The iptables cmd is more easy to understand and I even did an output parser and input generators, but tc is hard.