Re: DoS/DDoS Attack

["Kevin Willock (IGSN Security)" <kevin () igsn com>]

Wallisch, Philip wrote:

> I wouldn't say "no way of determining".  Check out http://www.riverhead.com/
>
> Through the use of baselines and complicated algorithms you can scrub at least some of that traffic.
>
> -----Original Message-----
> From: Faisal Khan [mailto:faisal () netxs com pk]
> Sent: Friday, January 14, 2005 1:06 AM
> To: pen-test () securityfocus com
> Subject: DoS/DDoS Attack
>
>
>
>
> Folks,
>
> Two quick questions.
>
> When IP (Source) addresses are spoofed, is there no way of determining (a) 
> that the IP Source Addresses is spoofed and not the genuine one (b) to be 
> able to determine the actual IP address that is sending DoS packets?
>
> Somehow I get the feeling I'm SOL when trying to find out the 
> "genuine/actual" source IP address.
>
> If this is the case, then pretty much we all are helpless with DoS/DDoS 
> attacks - considering one can write a script/program to keep incrementing 
> or randomly assigning spoofed source addresses in the DoS packets being 
> sent out.
>
> Faisal
>
>
>
>
>
> Faisal Khan,  CEO
> Net Access Communication
> Systems (Private) Limited
> ________________________________
>
> Network Security - Secure Web Hosting
> Managed Internet Services - Secure Email
> Dedicated Servers - Reseller Hosting
>
> Visit www.netxs.com.pk for more information.
>
>
>  
There are a lot of devices out there that can mitigate attack traffic. 
These devices work to varying degrees of effectiveness. The new trend is 
to inject data into a table, and get a baseline for what "normal" 
traffic is on your system. Then when abnormal traffic begins to appear 
these devices will compare against your regular traffic and the new 
flurry of packets that are coming in, and make intelligent decisions 
(based on commonalities that appear in traffic (IE: incrementing packet 
#'s, same TTL etc).

These devices are costly, and are sometimes beyond the scope of some 
operators, but you can discuss with your ISP getting actively involved 
in implementing a device, and offering the service to a range of clients 
at a fee to cover the costs of purchasing and administrating these 
devices. There are also third party groups that offer packet scrubbing 
services, and employ multiple devices and offer a sort of proxy service. 
These groups are now offering SLA's and when gauged against the cost of 
outright buying one of these devices and training staff to administrate 
them, is often a more economically feasible solution to the problem.

Kevin Willock
IGSN Security