Set up a dhcp/iptables/ LINUX firewall .
I run a script that monitors the net for
a rush of packets (ICMP/port 135/smurf attack)
it works great!
heres the algorithm in pseudocode - any net admin
should be able to put it together. You basically
monitor 1000 packets and count the number packets
per host and find the packet count per time
then dump if they are pushing 90% or more packets
while (true)
do
t0 = timeinseconds
packetlist = tcpdump -n -i -c1000
t1 = timeinseconds
iplist = grep list|print ipfield| uniq -c
totalscanseconds = t1-t0
totalpackets = count(packetlist)
if totalpackets greater than 99%
iptables -t -nat -A PREROUTING -s offendingip
-d 0/0 --dport 80 -j DNAT --todestination
and viola! all users flooding the net
are automatically forwarded to a you are quarantine website no matter what. All packets are dumped before they go any further.
I can handle easily 500 - 700 connections
with a dual AMD 1800 cpu / 500meg ram
dual nics setup as a dhcp server
its just a matter of time before Goliath (MS) gets
his head lopped off!
AMinfo
yep
All of a sudden the trend to move to .NET
has empowered the Web developer into thinking
they are the demigods of the development world.
Thats why they need network admins, database
admins and security admins
Thank You Microsoft
"Info World" Sept Issue has a great article on the Q
if SCO Wins or Looses.
Their bets are on IBM.
Anyhow debian fans can always move to
Debian Hurd !!!
Set up a dhcp/iptables/ LINUX firewall . I run a script that monitors the net for a rush of packets (ICMP/port 135/smurf attack) it works great! heres the algorithm in pseudocode - any net admin should be able to put it together. You basically monitor 1000 packets and count the number packets per host and find the packet count per time then dump if they are pushing 90% or more packets while (true) do t0 = timeinseconds packetlist = tcpdump -n -i -c1000 t1 = timeinseconds iplist = grep list|print ipfield| uniq -c totalscanseconds = t1-t0 totalpackets = count(packetlist) if totalpackets greater than 99% iptables -t -nat -A PREROUTING -s offendingip -d 0/0 --dport 80 -j DNAT --todestination and viola! all users flooding the net are automatically forwarded to a you are quarantine website no matter what. All packets are dumped before they go any further. I can handle easily 500 - 700 connections with a dual AMD 1800 cpu / 500meg ram dual nics setup as a dhcp server