nanog mailing list archives
Re: DDOS solution recommendation
From: Scott Fisher <littlefishguy () gmail com>
Date: Mon, 12 Jan 2015 16:51:58 -0500
In looking at this thread, it's apparent that some are trying to over-simplify a not-so-simple problem. As someone brought out earlier, there is no silver bullet to fix for several reasons. Some reasons that I can come up with at the top of my head are: 1) DDOS types vary. 2) Not every network is the same (shocker I know) 3) Time/Money - not every company has the same budget (again, shocker) 4) Staff/Resources - Not every company have admin/engineers at different technical levels. So someone may decide on blocking an attack at different levels because "that's what they know." EG: wordpress guy blocks attacks at the webserver level, an admin blocks it at the system, network admin at the edge. The questions should be much more narrow. "How should I mitigate an NTP reflection" or "what are common mistakes people make when mitigating attacks" are questions that more specific that all can glean from. Thanks, Scott On Mon, Jan 12, 2015 at 4:35 PM, Mike Hammett <nanog () ics-il net> wrote:
So the preferred alternative is to simply do nothing at all? That seems fair. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com ----- Original Message ----- From: "Christopher Morrow" <morrowc.lists () gmail com> To: "Brandon Ross" <bross () pobox com> Cc: "Mike Hammett" <nanog () ics-il net>, "NANOG list" <nanog () nanog org> Sent: Monday, January 12, 2015 3:05:14 PM Subject: Re: DDOS solution recommendation On Mon, Jan 12, 2015 at 3:17 PM, Brandon Ross <bross () pobox com> wrote:On Sun, 11 Jan 2015, Mike Hammett wrote:I know that UDP can be spoofed, but it's not likely that the SSH, mail, etc. login attempts, web page hits, etc. would be spoofed as they'd have to know the response to be of any good.Okay, so I'm curious. Are you saying that you do not automatically block attackers until you can confirm a 3-way TCP handshake has been completed, and therefore you aren't blocking sources that were spoofed? If so, how are you protecting yourself against SYN attacks? If not, then you've made it quite easy for attackers to deny any source they want.this all seems like a fabulous conversation we're watching, but really .. if someone wants to block large swaths of the intertubes on their systems it's totally up to them, right? They can choose to not be functional all they want, as near as I can tell... and arguing with someone with this mentality isn't productive, especially after several (10+? folk) have tried to show and tell some experience that would lead to more cautious approaches. If mike wants less packets, that's all cool... I'm not sure it's actually solving anything, but sure, go right ahead, have fun. -chris
-- Scott
Current thread:
- Re: DDOS solution recommendation, (continued)
- Re: DDOS solution recommendation Mark Andrews (Jan 11)
- Re: DDOS solution recommendation Grant Taylor (Jan 11)
- Re: DDOS solution recommendation Mark Andrews (Jan 11)
- Re: DDOS solution recommendation Valdis . Kletnieks (Jan 12)
- Re: DDOS solution recommendation Brandon Ross (Jan 12)
- Re: DDOS solution recommendation Christopher Morrow (Jan 12)
- Re: DDOS solution recommendation Mike Hammett (Jan 12)
- Re: DDOS solution recommendation Christopher Morrow (Jan 12)
- Re: DDOS solution recommendation Roland Dobbins (Jan 12)
- Re: DDOS solution recommendation William F. Maton Sotomayor (Jan 12)
- Re: DDOS solution recommendation Scott Fisher (Jan 12)
- Re: DDOS solution recommendation Roland Dobbins (Jan 12)
- Re: DDOS solution recommendation Brandon Ross (Jan 13)
- Re: DDOS solution recommendation Valdis . Kletnieks (Jan 12)
- Re: DDOS solution recommendation Colin Johnston (Jan 12)
- Re: DDOS solution recommendation Patrick W. Gilmore (Jan 11)
- Re: DDOS solution recommendation Roland Dobbins (Jan 12)
- Re: DDOS solution recommendation Owen DeLong (Jan 12)
- Re: DDOS solution recommendation Roland Dobbins (Jan 11)
- Re: DDOS solution recommendation Joel Maslak (Jan 11)
- RE: DDOS solution recommendation David Hofstee (Jan 12)