On Fri, Oct 29, 2010 at 12:03 PM, Kieran Tully <kieran.tully at gmail.com> wrote:
>> At http://deflate.medialayer.com/ there is a script called DDoS-Deflate
>> It adds iptables rules to blackhole machines that make more connections than
> the threshold. It's a little bit rough around the edges, but if it manages to
> understand the output of netstat on your system, it does work quite well. It
> costs relatively little to block a host.
I don't know if DDoS-Deflate counts connections in SYN_RECV to
blacklist but someone could craft a SYN packet with a spoofed IP of an
upstream router and have your device blacklist itself off the
Internet. Hopefully it is has a way of whitelisting IPs.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
