In the field of cybersecurity, DDoS (Distributed Denial of Service) attacks are blunt yet common. Web applications, due to their public domain names and IPs, and their use of specific communication protocols (TCP), are particularly vulnerable to DDoS attacks. Since Friendly Speed launched 9 months ago, it has suffered over 20 DDoS attacks, with some traffic volumes exceeding 100 Gbps.
There are many terms used to distinguish DDoS attack types, such as SYN Flood, UDP Flood, ICMP Flood, CC attacks, etc. From a defense perspective, these can mainly be categorized into two types: bandwidth consumption attacks and resource consumption attacks.
Bandwidth Consumption Attacks
Bandwidth consumption attacks aim to block the system’s network entry and exit points. They mostly rely on simple network protocols, such as UDP or ICMP, sending massive amounts of data packets to a specified IP. Such attacks can only be defended against by increasing network bandwidth. If the traffic is exceptionally large and exceeds the capacity of the data center’s network, third-party traffic scrubbing services must be used, such as Safebao or Tencent Dayu.
These scrubbing services primarily provide two types of assistance:
- CNAME Resolution to Hide Real IP: The domain name is resolved via CNAME, hiding the application’s real IP. The IP result for domain resolution is the protection IP address; attack traffic first reaches the protection data center, while the application’s real IP is only visible to the protection service provider.
- Traffic Scrubbing and Healthy Traffic Return: The service provider uses technical means to intercept attack traffic and filter out healthy traffic to send back to the origin server.
Resource Consumption Attacks
Resource consumption attacks primarily aim to exhaust system resources. For example, SYN Flood causes hosts to establish a large number of TCP connections, exhausting system handles. CC attacks initiate a large number of normal requests, exceeding the processing limit of the business application. The volume of traffic in these attacks depends on the number of botnets used by the attacker. If the traffic is exceptionally large, the aforementioned traffic scrubbing services are also required. If the traffic scale is not large, simple scripts can be used to identify the attacking proxy IPs and block them for defense.
The HTTP or SSL protocols used by websites are applications based on the transport layer TCP protocol. The state changes in the TCP protocol are as follows:
You can determine if an IP is attacking by identifying the number of TCP connections in different states.
For instance, a SYN Flood attack consumes server handles by establishing TCP connections in the SYN state. When suffering from this attack, the server can observe that many TCP connections are in the syn-recv state.
CC attacks usually involve initiating a large number of requests to the website, establishing many TCP connections with the server, most of which are in the established, time-wait, or close-wait states.
Using the ss command in the Linux system, you can view TCP connections in various states:
ss -ntu state syn-recv state established state time-wait
By viewing the TCP connection states and quantities of an IP, you can determine if that IP is being used for DDoS attacks.
Based on this approach, we developed a simple script tool called AntiDDoS for resource consumption attacks. After deploying and starting it on the server, it periodically checks TCP connections. IPs exceeding a specified connection count will be added to iptables for blocking for a certain period, and an email notification will be sent to the system administrator.
Download Link:
https://github.com/yeezon/AntiDDoS
Simple iptables Protection
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s --limit-burst 5 -j ACCEPT # Allow max 5 new connections per second
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT # Prevent various port scans
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT # Ping flood attack (Ping of Death)
Blocking an IP
# iptables -I INPUT -s 192.168.0.1 -j DROP
How to Prevent Others from Pinging
# iptables -A INPUT -p icmp -j DROP
Prevent Sync Packet Flood (Sync Flood)
# iptables -A FORWARD -p tcp –syn -m limit –limit 1/s -j ACCEPT
Prevent Various Port Scans
# iptables -A FORWARD -p tcp –tcp-flags SYN,ACK,FIN,RST RST -m limit –limit 1/s -j ACCEPT
Ping Flood Attack (Ping of Death)
# iptables -A FORWARD -p icmp –icmp-type echo-request -m limit –limit 1/s -j ACCEPT
# NMAP FIN/URG/PSH
# iptables -A INPUT -i eth0 -p tcp –tcp-flags ALL FIN,URG,PSH -j DROP