4 ms·
Since I moved my DNS records to Cloudflare (that is: nameserver is now the one from Cloudflare), I get tons of odd connections, most notably SYN packets to eiht
by qwertox 11mo ago
Since I moved my DNS records to Cloudflare (that is: nameserver is now the one from Cloudflare), I get tons of odd connections, most notably SYN packets to eihter 443 or 22, which never respond back after the SYN-ACK. They ping me once a second in average, distributing the IPs over a /24 network.
I really don't understand why they do this, and it's mostly some shady origins, like vps game server hoster from Brazil and so on.
I'm at the point where i capture all the traffic and looks for SYN packets, check the RDAP records for them to decide if I then drop the entire subnets of that organization, whitelisting things like Google.
Digital Ocean is notoriously a source of bad traffic, they just don't care at all.
- kzemek 11mo agoThese are spoofed packets for SYNACK reflection attacks. Your response traffic goes to the victim, and since network stacks are usually configured to retry SYNACK a few times, they also get amplification out of it
- pabs3 11mo agoThere is a solution to that, but it requires these companies to implement source address validation. If your ISP is on the list, maybe complain about it. https://spoofer.caida.org/as_stats.php https://spoofer.caida.org/as_stats.php
- sva_ 11mo ago> like vps game server hoster from Brazil and so on. Probably someone DDoSing a Minecraft server or something. People in games do this where they DDoS each other. You can get access to a DDoS panel for as little as $5 a month. Some providers allow for spoofing the src ip, that's how they do these reflection attacks. So you're not actually dropping the sender of these packets, but the victims. Consider turning reverse path filter to strict as a basic anti spoofing method and see if it helps net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1
- qwertox 11mo agoThanks, it never came to my mind.
- cute_boi 11mo agoI believe kernel should make this behavior as default.
- jcalvinowens 11mo agoHow does rp_filter on the server side help at all? For a cloud server with a single interface it literally does nothing. Maybe I'm misunderstanding your suggestion.
- ranger_danger 11mo ago> Digital Ocean is notoriously a source of bad traffic, they just don't care at all. Why should it be an ISP's job to police what their users can and can't do? I really don't think you want service providers to start moderating things. Does your electricity company ban the use of red light bulbs? Would everyone be ok with such restrictions?
- selectodude 11mo agoNo but your electricity company will absolutely rat you out if your electricity usage skyrockets and the police will pop by to see if you’re running a grow op or something.
- esseph 11mo agoNot anymore (depending on the state, and not since LED grow lights).
- ranger_danger 11mo agoThis is why I don't open the door for anyone. If the police really want in, they won't be using the doorbell anyways.
- 0xedd 11mo ago[dead]