Um... Woah... lost you there. How does this help? How can you
differentiate between spoofed and real SYNs coming into one of your
services, if those SYNs are choking your bandwidth (and not your
memory)?
True - if SYNs are choking bandwidth, then you cannot differentiate between
spoofed and real SYNs, as there is no bandwidth left to send back SYN
Cookies or perform SYN Proxying in order to verify that those source
addresses are real.
The solution is to get more bandwidth so you have the spare network capacity
to verify source addresses. This extra bandwidth can either be your own
(preferably in burstable form), or belong to a shared anti-DDOS service
further upstream.
You might say 'Why bother buying more bandwidth in order to defend against
SYN floods?', or 'Why can't the ISP deal with this anyway, it's not my
problem?', but at the end of the day, if a SYN Flood is causing a business
problem (ie loss of earnings due to web site outage), then the only way to
effectively deal with this is to invest in more bandwidth (usually in the
form of a guaranteed burstable Internet feed), bring the whole of the attack
in-house, and attempt to mitigate it, or of course, pay somebody else to do
it (ie a service provider offering anti-DDOS services).
Regards,
Tim
-----Original Message-----
From: Tim [mailto:tim-security@sentinelchicken.org]
Sent: 17 January 2005 15:40
To: THolman@toplayer.com
Cc: focus-ids@securityfocus.com
Subject: Re: IDS: Snort detecting distributed syn floods
Detecting a SYN Flood is all very well, but what are you going to do once
you find out you're under attack ?
If all the sources are spoofed (as they usually are), then setting up an
upstream firewall rule to block these sources won't help, neither will
configuring your IDS to send RST packets (this would just double up
consumed
bandwidth).
You would be best off setting a netflow or ACL threshold on your upstream
router that alerts you when it starts receiving a lot of packets.
If you're finding DDOS attacks are consuming more than 10-20Mb bandwidth,
you will usually find smaller devices - routers, firewalls will start
falling over (even those with DDOS protection built in).
Yes, it is difficult to defend against.
This is where an IPS comes in.
Um... Woah... lost you there. How does this help? How can you
differentiate between spoofed and real SYNs coming into one of your
services, if those SYNs are choking your bandwidth (and not your
memory)?
tim
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
