lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <5.2.1.1.2.20030814195711.01195280@belegost.cimternet.com> From: llevier at argosnet.com (Laurent LEVIER) Subject: DDos counter measures All, We found a simple solution to protect our IntraNet against the DDoS. Since the msblast.exe will SYN flood windowsupdate.com (or windowsupdate.microsoft.com) with 50 packets per second (according to our tests). Since our IntraNet solves all its DNS queries through internal caches (mandatory bottleneck), we created windowsupdate.com & windowsupdate.microsoft.com zones in this bottleneck DNS. These are resolving to 127.0.0.1 with DNS wildcards. After the Microsoft DNS TTL has expired (15 minutes is the worst TTL), we got confirm all known windowsupdate domains hosts (www.windowsupdate.com, windowsupdate.microsoft.com, v3.windowsupdate.microsoft.com & v4.windowsupdate.microsoft.com) were resolved to localhost. We expect now the worm to flood the box it is hosted on and so preserving our IntraNet. Hope this can help others. Brgrds Laurent LEVIER Equant Information Technology & Systems - Equant Security Organization - Internal Network (WAN IntraNet) - Systems & Networks Security Expert Tel. CVN : 7223-1912, ext. (+33) 4 92 38 19 12
Powered by blists - more mailing lists