4 ms·
Couldn't they just keep adding IP's to some blacklist (not htaccess, but something more efficient), and the attackers will eventually run out of IPs to attack f
by AznHisoka 15y ago
Couldn't they just keep adding IP's to some blacklist (not htaccess, but something more efficient), and the attackers will eventually run out of IPs to attack from? There's only a finite # of computers you can really have control of. So you end up blocking some innocents, but you take care of that after the attack is over.
- rcthompson 15y agoI thought that botnet operators had methods of rapidly changing bots' IPs so as to defeat IP blocks.
- abraham 15y agoIf it is a smart DDoS the requests won't look any different than typical users visiting your site.
- Tobu 15y agoMaybe a whitelist could work. My IP has visited in the past week / I have a legit session cookie, now gimme bandwidth.
- brown9-2 15y agoThis only works if you decide you want to never accept a new customer again.
- AznHisoka 15y agoThis is only to block the attack. The thinking is when the attackers run out of PC's they will give up. You lose some customers in the short-term. If you don't do any blocking, they will just keep attacking and attacking.
- AznHisoka 15y agoThis is only to block the attack. The thinking is when the attackers run out of PC's they will give up. You lose some customers in the short-term. If you don't do any blocking, they will just keep attacking and attacking.
- dredmorbius 15y agoNot necessarily, though it depends on the complexity you want to throw at the problem. If you have known (and proven) legitimate traffic, give it a high QoS. For never-been-seen IPs, provide a limited initial rate, with training based on experience. Use tools such as the ASN Routeviews project to identify contiguous blocks of IP space (or any other source of BGP routing data, but the RV data are queryable via DNS and downloadable as zonefiles). ID bad actors and either block or severely limit them. Train up or down other traffic as appropriate. This leaves you tracking large amounts of IP space. Doable in IPv4, somewhat more difficult under IPv6, though you're still probably going to be able to do something reasonable. I'd like to see more of this pushed into the routing/networking layer, automatically, based on application-layer-based feedback. Maybe someday.
- zxoq 15y agoThe attacker is most likely using a program that spoofs the sender IP so every packet has a unique IP. It's not feasible to block that. You need a more intelligent router to block attacks of that kind (and lots of bandwidth).