3 ms·

> your server or if it's my neighbor doing that if we both share the same IP address? It depends on how sloppy you are running your attack. Most of the time th

> your server or if it's my neighbor doing that if we both share the same IP address? It depends on how sloppy you are running your attack. Most of the time the attacker will be sloppy and hit the system using the same useragent with the same cookies. Or maybe they'll go the other way and every single request will have some random BS for a useragent and random cookies. Plus they will only hit that exact single URL and won't bother loading the rest of the page. So if you look at your logs, you'll see a million requests for "large_ugly_cow.bmp" coming from the same IP with a useragent that doesn't bother loading anything else. In short, to a human such an attack usually stands out like a sore thumb. Writing the filter rules to block them... that is a different beast. With the right tools and a smart tech, it is totally possible though.

soheil 5y ago
But how do you do that with CG-NAT?
- spookthesunset 5y ago
  Good question! The fact you've got a thousand users on the same IP doesn't really change much honestly. Like I said, when you see this kind of attack happening it usually stands out in your monitoring. The trick is writing the filter rules to target it. Using IP addresses as filter / block criteria isn't very effective so most don't do it. Any attacker even a slight clue is hopping all over IP blocks to route around IP blocks so effective filtering rules use things other than IP addresses. In short, the fact that your "signal" (attacker) is using the exact same IP address as the "noise" (everybody else using the IP address) shouldn't be a problem.
- BenjiWiebe 5y ago
  Commonly on CGNAT your connection will be assigned a range of source ports. The web server can see that all your connections have a source port number between 10,000 and 20,000, for instance, so they block new connections in that range. This would not directly target you (unless there's only 6 customers per NATted IP) but it does reduce the blast radius.

soheil 5y ago

But how do you do that with CG-NAT?

spookthesunset 5y ago
Good question! The fact you've got a thousand users on the same IP doesn't really change much honestly. Like I said, when you see this kind of attack happening it usually stands out in your monitoring. The trick is writing the filter rules to target it. Using IP addresses as filter / block criteria isn't very effective so most don't do it. Any attacker even a slight clue is hopping all over IP blocks to route around IP blocks so effective filtering rules use things other than IP addresses. In short, the fact that your "signal" (attacker) is using the exact same IP address as the "noise" (everybody else using the IP address) shouldn't be a problem.
BenjiWiebe 5y ago
Commonly on CGNAT your connection will be assigned a range of source ports. The web server can see that all your connections have a source port number between 10,000 and 20,000, for instance, so they block new connections in that range. This would not directly target you (unless there's only 6 customers per NATted IP) but it does reduce the blast radius.