Search found 2 matches
- 11 Jan 2013, 16:54
- Forum: General Discussion (csf)
- Topic: [SYN flood attack] how to ban IP blocks if...
- Replies: 1
- Views: 5234
Re: [SYN flood attack] how to ban IP blocks if...
another idea: save a registry of SYN packets sent from each /24 IP block. Example: 192.132.209.* -> 24 SYN packets 105.75.136.* -> 2 SYN packets 217.160.69.* -> 15 SYN packets ... Every 1 minute (for example) the counter is resetted. If a range reaches 30 packets, the entire /24 block is banned. Why...
- 11 Jan 2013, 13:53
- Forum: General Discussion (csf)
- Topic: [SYN flood attack] how to ban IP blocks if...
- Replies: 1
- Views: 5234
[SYN flood attack] how to ban IP blocks if...
Hi all. I've been working in mitigating the attacks I'm suffering in my server and now I have a question. Is it possible to block IP ranges (IP blocks) when lets say 4 or more IPs from that block are already banned? Here is a small capture of the traffic on port 80 during the last attack: http://i.i...