Re: Help to defend from DOS web attacks

["Breno Brand Fernandes" <breno () lagosnet com br>]

Hi Emanuel,
   You can't block the attackers IPs, because they often use random 
sources. So, you should limit the packets which use SYN flag activeted, and 
use some protection like syn cookie that dont  let the attack allocate so 
memory in your gateway.

Att,
Breno Brand Fernandes

----- Original Message ----- 
From: "Emanuel Marufo" <marufos () gmail com>
To: <security-basics () securityfocus com>
Sent: Thursday, October 25, 2007 11:41 PM
Subject: Help to defend from DOS web attacks


> Hello,
>
> Recently somebody attack my web server, and i thinking defend from that.
>
> I readed the next article:
> http://www.quadrunner.com/index.php?option=com_content&task=view&id=151&Itemid=2
>
> but i want to know if can config a snort/portsentry to block attackers 
> ip's.