3 ms·
I've been behind a large often-targeted service for the last 10 years or so, and most of the large attacks we get are pretty easily filtered as our service is T
by blibble 14y ago
I've been behind a large often-targeted service for the last 10 years or so, and most of the large attacks we get are pretty easily filtered as our service is TCP (like CloudFlare), and most of the attacks we get are either ping or UDP floods, which we drop at the boundary.
a little harder is the SYN flood with spoofed addresses, how on earth can you filter those?
- FlukeATX 14y agoWith this: http://www.cisco.com/en/US/docs/ios/11_3/security/configuration/guide/scdenial.html http://www.cisco.com/en/US/docs/ios/11_3/security/configurat...
- swalberg 14y agoAren't SYN-cookies [0] the traditional defence against SYN floods? The proxy, or a device in front of it, could take care of that. Only connections that complete the 3 way handshake would take up any room in the connection table. 0 - http://tools.ietf.org/html/rfc4987 http://tools.ietf.org/html/rfc4987
- blibble 14y agoit's just the sheer amount of packets hitting our network that cause the issue, not what is inside them!
- Dylan16807 14y agoI don't understand. Why is it simple to filter UDP but not simple to filter based on a cookie? Is the validation cpu-expensive in bulk? Do you not have the capability to filter that way at the boundary?