full-disclosure - DDoS and the right way to react...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20040822191423.GC4981@freesbee.wheel.dk>
From: ssch at wheel.dk (Steffen Schumacher)
Subject: DDoS and the right way to react...

On 20.08.2004 23:58:18 +0000, van Helsing wrote:
> I've a server and it's DDoSed for a week now.
> I informed the ISPs but they don't react so what else can I do to stop a
> damn DDoS attack?
> 

You have to ask your ISP to null-route you ip. 
I don't know much about legislation, but I do think that the approach you will
have the most luck with, would be to change your SLA or contract with your
ISP, to include mechanisms for preventing and/or limiting DDoS attacks.
This is quite possible for them, if they use tools such as Arbour.

I don't think you'll have any luck with contacting the authorities on this..

/Steffen

> My server shows me about some houndrets entry like:
> 
> tcp        0      0  62.8.206.154.80        129.125.220.178.2056  
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        24.101.73.167.2011    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        83.27.195.87.13242    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        129.125.220.178.2055  
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        24.101.73.167.2010    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        129.125.220.178.2054  
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        24.101.73.167.2008    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        129.125.220.178.2053  
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        24.101.73.167.2007    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        129.125.220.178.2052  
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        24.101.73.167.2006    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        129.125.220.178.2051  
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        83.27.195.87.13240    
> FIN_WAIT_2
> tcp        0      0  62.8.206.154.80        24.101.73.167.2005    
> FIN_WAIT_2
> 
> 
> So what can I do?
> Or: Could somebody tell me how to contact the police in poland,
> netherland and the other country?
> 
> Thanks for some tipps....
> 
> 
> vh