LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-26-2013, 01:46 AM   #1
niraj.vara
LQ Newbie
 
Registered: May 2009
Posts: 23

Rep: Reputation: 0
fwsnort firewall not ablet to detect the DDos attack


Hi

I have installed the fwsnort and psad in centos.
I was able to block any unwanted traffic with fwsnort and psad but I was not able to block the DDOS attack in fwsnort.

I was creating the DDOS attack via LOIC tools and DosHTTP.

Please guide for the same.
 
Old 04-26-2013, 12:37 PM   #2
vishesh
Member
 
Registered: Feb 2008
Distribution: Fedora,RHEL,Ubuntu
Posts: 660

Rep: Reputation: 66
Can you please share Iptables rules getting generated.
 
Old 04-26-2013, 02:36 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,472
Blog Entries: 54

Rep: Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901
DDoS attempts simply are not blocked efficiently at the end point: for that you need upstream cooperation. Any attempt to misinform or misguide the OP should be considered utterly futile.
 
Old 04-29-2013, 12:11 AM   #4
niraj.vara
LQ Newbie
 
Registered: May 2009
Posts: 23

Original Poster
Rep: Reputation: 0
Hi

@vishesh : I was trying to attached the rule but forum not allowed to attached size more than 256 kb.
 
Old 04-29-2013, 01:37 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,472
Blog Entries: 54

Rep: Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901
Then either you're trying to attach a lot of crud or you're trying to attach some binary.
Regardless of that the fact remains DDoS attempts simply are not blocked efficiently at the end point.
See for example http://www.linuxquestions.org/questi...ck-4175459826/.
 
Old 04-29-2013, 02:02 AM   #6
niraj.vara
LQ Newbie
 
Registered: May 2009
Posts: 23

Original Poster
Rep: Reputation: 0
Hi

its not binary , first it was trying .txt file but its having the 9 Mb size so i have zipped the file with bunzip command.

then I was trying that bzip file which having 600kb file size. its show that only allowed size is 256kb.
 
Old 04-29-2013, 06:57 AM   #7
niraj.vara
LQ Newbie
 
Registered: May 2009
Posts: 23

Original Poster
Rep: Reputation: 0
Hi

I am able to detect the DDOS attack with fwsnort with psad. I was doing the R&D with psad configuration and I was able to detect the same via fwsnort.

But the one problem is there with that when I set the fwnort firewall with the only the following command

fwsnort
/var/lib/fwsnort/fwsnort.sh

and then I browsing the my application which is hosted on this server. in that I found the following log
"WEB-MISC whisker tab splice attack" (sid: 1087)

for my server's genuine request i found the following so I have decided to exclude the same in fwnort then I run the following

fwnort --exlude-sid 1087
/var/lib/fwsnort/fwsnort.sh

and then again I start the dos attack this time I was not able to block the ddos attack.

Please suggest what sud I required so my genuine request will not logged(means firewall rule sud detect as a normal request) in firewall and I able block the ddos attack also.
 
Old 04-29-2013, 01:05 PM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,472
Blog Entries: 54

Rep: Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901Reputation: 2901
Quote:
Originally Posted by niraj.vara View Post
block the ddos attack also.
DDoS attempts simply are not blocked efficiently at the end point.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how can detect ddos attack in ns2 simulator under Ubuntu evkanjia Linux - Software 0 04-03-2013 09:44 AM
DDOS attack help me dheeraj4uuu Linux - Security 9 05-31-2009 03:07 PM
DDOS Attack studiofos Linux - Security 3 09-12-2006 03:42 AM
ddos attack ashis Linux - Security 1 06-14-2001 02:31 AM


All times are GMT -5. The time now is 04:33 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration