On Thu, Oct 07, 2004 at 12:19:28PM -0300, Marc G. Fournier wrote: > > I've got 5 servers sitting on a 10/100 unmanaged switch right now ... last > night, a DDoS attack against a network "beside us" cause 70+% packet loss > on our network, and I'm trying to figure out if there is anything I can do > from my side to "compensate" for this ... > > I run ipaudit on all our servers, and a normal 30 minute period looks > like: > > neptune# gzcat 2004-10-06-22:00.txt.gz | grep 200.046.204 | wc -l > 12107 > neptune# gzcat 2004-10-06-22:00.txt.gz | grep -v 200.046.204 | wc -l > 112 > neptune# gzcat 2004-10-06-22:00.txt.gz | wc -l > 12219 > > where 200.046.204 is our C-class ... > > Now, when the DDoS attack is running, those stats change to: > > neptune# gzcat 2004-10-06-17:30.txt.gz | grep 200.046.204 | wc -l > 5815 > neptune# gzcat 2004-10-06-17:30.txt.gz | grep -v 200.046.204 | wc -l > 594189 > neptune# gzcat 2004-10-06-17:30.txt.gz | wc -l > 600004 > > We're getting *alot* of traffic on our network that just is not ours ...
Seems that when the CISCO box upstream gets overloaded it starts
sending packets everywhere, instead of just to the networks they're
intended for.
You could put in a filtering bridge upstream of your unmanaged switch,
which would let you strip out everything not intended for your
assigned subnet. However, as your FreeBSD servers seem to be handling
the load just fine, that probably won't do you much good.
If the switch upstream of you is completely overloaded, there's not a
lot you can do, other than get your network moved over to some less
loaded equipment.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
pgpCMWOjZsAAh.pgp
Description: PGP signature
