[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [hobbit] Hobbit DDOS Attack Detection (submission)
- To: hobbit (at) hswn.dk
- Subject: Re: [hobbit] Hobbit DDOS Attack Detection (submission)
- From: Charles Jones <jonescr (at) cisco.com>
- Date: Fri, 25 Jan 2008 14:28:13 -0700
- Authentication-results: sj-dkim-1; header.From=jonescr (at) cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; );
- Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; l=565; t=1201296495; x=1202160495; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jonescr (at) cisco.com; z=From:=20Charles=20Jones=20<jonescr (at) cisco.com> |Subject:=20Re=3A=20[hobbit]=20Hobbit=20DDOS=20Attack=20Det ection=20(submission) |Sender:=20; bh=UVSHFkAu5/osMhQ33f5ha0xRQEp4R3wJ/JZ2aLra+vQ=; b=f+ctXWxP0OTOl3zSuJLWdsVUsGhGPzYkzgE+n6xmzBrOril1VJbzN0YrqX BSxc3uQ7VjAZ/cYmz1CnM+kD0gzJMtehYP3hz75yJ2bjChzS74tfDpMwWXut 71tLr403ZcaR/zQEYxW5IZTs40VjcQVwtwnEA+0ByFQ5vLkVW7Yzk=;
- References: <479A4D9C.8080109 (at) cisco.com> <961092e10801251309w73c0377dhd954eeb96fb895cd (at) mail.gmail.com>
- User-agent: Thunderbird 2.0.0.9 (X11/20071115)
Josh Luthman wrote:
What kind of firewall do you have for your Hobbit? The firewall rules
on my router detect these kinds of script kiddie attacks...
I admin and consult on numerous Hobbit installations. This particular
one is a small web cluster whose dedicated hosting provider has no IDS
or decent firewall, as they get hit by these sorts of attacks and the
only way to stop them is to request the blockage of specific IPs. I
didn't mean to imply the "patch" I submitted was for everyone, just
those who might find it useful :)
-Charles