5 ms·
This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 socket
by Matheus28 9y ago
This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 sockets open in your process, 30 per IP is plenty to prevent most attackers.
IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.
- gruez 9y ago>IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64. Works great until your users use an ISP that hands out /128 rather than /64
- moviuro 9y ago> ISP that hands out /128 rather than /64 Seriously? Who even hands out one single /64 or smaller? it's not like handing out /48s instead is going to deplete the IPv6 pool space [0]. [0] https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+earth https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+e...
- magnat 9y ago> Who even hands out one single /64 or smaller? Budget VPS/dedicated server providers, such as OVH: https://www.kimsufi.com/en/servers.xml https://www.kimsufi.com/en/servers.xml
- moviuro 9y agoI didn't even try to use their provided IP(s). I immediately turned to https://tunnelbroker.net https://tunnelbroker.net (only tunnel broker left?)
- jandrese 9y agoDigitalOcean hands out /124s. Then they realized that blackholes were hitting multiple droplets (VMs) at once because people blackhole entire /64s, so their solution was to block ports on IPv6 instead of doing the sensible thing and handing out /64s to the droplets instead.
- deleted 9y ago[deleted]
- slenk 9y agoDoesn't Comcast only hand out /64 to its residential customers?