3 ms·
I'm assuming you also want a simple way to mitigate layer 7 attacks, which is the hard part. You can try something like gathering statistics of /24 IP subnets t
by zzzcpan 7y ago
I'm assuming you also want a simple way to mitigate layer 7 attacks, which is the hard part. You can try something like gathering statistics of /24 IP subnets that make connections to your server and once you detect increase in unseen subnets that goes over some threshold you think your server can't handle - nullroute unseen subnets that go over that threshold for some short period of time. And on a web server side configure rate limiting for everything.
- thegeekbin 7y agoI’ve done some basic filtering against some slowloris etc type attacks, I’ve got lots of open proxy and relays blocked from the web. I’ve also got rate limiting in place now, and I’m offloading assets to a proper CDN. In the end my server should only serve a few hundred KB at absolute max, the rest handled by a CDN. My thought is with that it probably would hold up to the attacks. Thoughts?
- zzzcpan 7y agoImagine something like a pingback attack [1], it can hit you from at least tens of thousands of IPs you don't yet filter, because they are not proxies or relays and will likely exhaust various resources: file descriptor, socket limits, CPU. And this is one of the most primitive layer 7 attacks not even attempting to look like a real user agent. [1] https://en.wikipedia.org/wiki/Pingback#Exploits https://en.wikipedia.org/wiki/Pingback#Exploits