nanog mailing list archives
Re: Over a decade of DDOS--any progress yet?
From: Jeffrey Lyon <jeffrey.lyon () blacklotus net>
Date: Wed, 8 Dec 2010 11:30:15 -0500
We see a lot of the UDP dest 0. Depending on what you're hosting/protecting you can ACL a lot of the unneeded ports and protocols (easy) then focus on using appliances (commercially available or home grown if you're so inclined) to identify and scrub out the ambiguous traffic (a lot more difficult). Jeff On Wed, Dec 8, 2010 at 11:17 AM, Jack Bates <jbates () brightok net> wrote:
On 12/8/2010 10:13 AM, Drew Weaver wrote:The most common attacks that I have seen over the last 12 months, and let's say I have seen a fair share have been easily detectable by the source network. It is either protocol 17 (UDP) dst port 80 or UDP Fragments (dst port 0..) What valid application actually uses UDP 80? You could literally wipe out a large amount of these attacks by simply filtering this. -DrewYou mean silly things like: Warning, it is an 87160 line flow capture. http://www.brightok.net/~abuse/ddos/flows.txt Jack
-- Jeffrey Lyon, Leadership Team jeffrey.lyon () blacklotus net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions
Current thread:
- Re: Over a decade of DDOS--any progress yet?, (continued)
- Re: Over a decade of DDOS--any progress yet? Thomas Mangin (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Thomas Mangin (Dec 09)
- Re: Over a decade of DDOS--any progress yet? Arturo Servin (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Dobbins, Roland (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Jeffrey Lyon (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Arturo Servin (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Dobbins, Roland (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Jack Bates (Dec 08)
- RE: Over a decade of DDOS--any progress yet? Drew Weaver (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Jack Bates (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Jeffrey Lyon (Dec 08)
- Re: Over a decade of DDOS--any progress yet? Michael Costello (Dec 08)
- RE: Over a decade of DDOS--any progress yet? Drew Weaver (Dec 10)
- Re: Over a decade of DDOS--any progress yet? Michael Costello (Dec 11)
- Re: Over a decade of DDOS--any progress yet? Dobbins, Roland (Dec 08)
- RE: Over a decade of DDOS--any progress yet? Drew Weaver (Dec 10)