udp flood tool crashes LVS-NAT from the inside

["Mickey Everts" <mickey-ml@xxxxxxxxxxxxx>]

Today I had an incident at work where an attacker used a PHP exploit to grab
the following script and run it from one of our "real servers" (running as
apache's permissions):

 

http://www.packetstormsecurity.org/DoS/udp.pl

 

This rather short script brought our LVS box, a 3 GHz Pentium 3 system with
dual gigabit interfaces, to its knees.  Note that it's actually connected to
a 100megabit interface.  Obviously we want to secure our real servers, but
is there any way to stop this kind of thing from killing our LVS server so
easily?

 

Regards,

 

Mickey