Question about ddos attacks.
- Thread starter Energize
- Start date
Big DoS attacks are sent from thousands of computers. You'd need to get the server up for long enough to add those IPs to the block list.
Even then, if someone is determined to take down your server they'll just use a whole new set of zombied computers.
Even then, if someone is determined to take down your server they'll just use a whole new set of zombied computers.
Any system you put in place to limit or block ip address will still have to use CPU cycles and bandwidth to a) determine that a packet has arrived and b) figure out where it came from. If your server is on a 10Mbit line, and I'm sending you 1 million, 100-byte packets per second (that's 100MB/s), most of the bandwidth is going to be used carrying these packets, which doesn't give anything else much of a chance to get through.
So, a well Ddos attack will make you (a) run out of bandwidth preventing legitimate requests from getting to you, and (b) make you run out of processing power which stops legitimate requests from being processed properly.
So, a well Ddos attack will make you (a) run out of bandwidth preventing legitimate requests from getting to you, and (b) make you run out of processing power which stops legitimate requests from being processed properly.
Energize said:
Because the source address of the packets is often spoofed. What you need is a firewall to analyse the packets, decide which are DDoS and which are legitimate traffic and block accordingly. Of course you still have to deal with upstream link saturation and/or your ISP cutting you off
.No, because under a DDoS you would be blocking your legitimate traffic too.
Depends entirely on your target.
Man of Honour
- Joined
- 17 Nov 2003
- Posts
- 36,747
- Location
- Southampton, UK
There are loads of variables. The server spec, the application that is listening for the packets, the network infrastructure to name a few.
Man of Honour
- Joined
- 17 Nov 2003
- Posts
- 36,747
- Location
- Southampton, UK