DDOS attack - What can be done?

priyanka · (#1 (**permalink**))

Hi guys,
Many times clients find their website down. On contacting the web host they come to know that their website is down because of DDOS attack. What exactly is this Distributed-Denial-of-Service attack? Marson(2002) states that distributed DoS attack occurs when a hacker hijacks machines across the Internet and uses them to send a flood of requests to a server until it becomes overwhelmed and stops functioning.
I am just wondering is ICMP blocking only the solution for this?

datums · (#2 (**permalink**))

ICMP is just one type of attack..

To learn more about DDoS Attacks in general click here
http://www.datums.net/DDoSAttack.pdf

Quote:

Originally Posted by priyanka-m6.net

Hi guys,
Many times clients find their website down. On contacting the web host they come to know that their website is down because of DDOS attack. What exactly is this Distributed-Denial-of-Service attack? Marson(2002) states that distributed DoS attack occurs when a hacker hijacks machines across the Internet and uses them to send a flood of requests to a server until it becomes overwhelmed and stops functioning.
I am just wondering is ICMP blocking only the solution for this?

InfluxHosting · (#3 (**permalink**))

Theres no fail safe way to block such attacks unfortunetly. Theres precauationary measures that can be taken such as apf, mod_dosevassive etc etc.

However, Such attacks can be halfed or maybe even stopped at the router, such places as ThePlanet will enable such security measures if an attack begins.

SeanR · (#4 (**permalink**))

A judicious use of iptables, route, sometimes we've even used string matching w/iptables, excellent communication with upstream providers and some clever scripting are what we usually use. Some of our clients have had success with the smaller netscreens as well. Most of the DDOS's we see are virus driven rather than mass hacke zombie machines.