|
Hi,
My conception is, human usually do not eshtablish SYN connection as
more as Nimda or other worms, if I can determine a threshold of
simultenious SYN connection that nimda usually creates, probably I
will be able to drop packets from specific source IP which meet the
threshold. There is chance of false positive - I agree.
Another risk is if the attackers are forging their source IP addresses.
I don't think your threshhold approach would work in this case.
Have you heard of SYNCookies? http://cr.yp.to/syncookies.html
I think that should stop any SYN flood type of Denial of Service attack,
and also should allow all legitimate traffic to get through.
Search google using my name and syncookies for more information on why syn
cookies have no measurable impact on reducing real DoS.
Best regards,
Roberto Nibali, ratz
--
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc
|
