Preventing DOS Attacks?

clubar · 09-22-2004, 03:05 PM

Hey there,

I was wondering if you guys could tell me the best ways to prevent/block/stop DOS attacks. I want to make the server as bulletproof to attacks as possible.

I have looked at a bunch of sites already but of course there are probably some I have missed. So any suggestions would be great.

Cheers,
Sebastian

Capt_Caveman · 09-22-2004, 04:46 PM

You can enable tcp_syncookies and modify several kernel networking parameters, however there is really only so much you can do. If your connection is being flooded with a massive amount of bandwidth, you really have no choice but to work with your ISP to try and control the DoS attack further upstream at their intermediate routers. That and try to avoid pissing off people in control of large bot nets

Here's some links on DoS attacks and steps you can take to try and minimize their impact:
http://cr.yp.to/syncookies.html
http://www.securityfocus.com/infocus/1729

servnov · 09-22-2004, 09:54 PM

No one can totally prevent DoS attacks, just by the attacks nature. Dropping pings (ICMP protocols), intelligent partitioning scheme customized to your server's needs, and a good firewall implementation will all help. If you run anonymous FTP make sure anonymous users don't have write access for sure...