detener un DDoS

Ver el tema anterior Ver el tema siguiente Ir abajo

default detener un DDoS

Mensaje por Lorena Wells el Dom Ago 04, 2013 2:20 pm

Porque un null-route a una ip no es una solución, es una chapuza.

Si unos script-kiddies están DDoSeando tu web.....
1) Se basa en ataques reales.
2) No hay nada de teoría, solo parte práctica.
A) Detectando el ataque

1) Usando el comando netstat

Código:
netstat -an | grep :80 | sort
Código:
netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'
Código:
netstat -n -p|grep SYN_REC | wc -l
Código:
netstat -lpn|grep :80 |awk '{print $5}'|sort
Código:
netstat -an | grep :80 | awk '{ print $5 }' | awk -F: '{ print $1 }' | sort | uniq -c | sort -n

Ejemplo de ataque SYN_RECV o SYN Flooding al Apache (puerto 80).

192.168.0.3 es la ip del servidor apache y 192.168.0.105 es la ip del "atacante".
Código:
tcp        0      0 192.168.0.3:80          192.168.0.5:60808     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60761     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60876     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60946     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60763     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60955     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60765     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60961     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60923     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61336     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61011     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60911     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60758     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60828     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61114     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61074     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60826     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60959     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60900     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60940     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60920     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60825     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60945     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60913     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61009     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60755     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60904     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61583     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60910     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60915     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60827     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61458     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60908     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61007     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60927     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60951     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60942     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61113     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60909     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60822     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60894     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60952     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60928     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60936     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60906     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61466     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60919     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60914     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60926     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60939     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60931     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60831     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60823     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60954     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60916     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60963     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60947     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61006     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60933     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60950     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60895     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60917     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61480     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60935     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60960     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60767     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60918     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60821     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61077     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60905     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61517     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60893     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60953     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60903     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61439     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61337     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61545     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61299     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61010     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60930     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60744     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60929     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60754     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61008     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61116     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60811     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60807     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60938     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60764     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60873     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60817     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61550     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60748     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60956     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60753     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61115     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60741     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61075     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60948     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60829     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60943     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61338     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60762     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60824     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60830     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61535     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60898     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60815     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60962     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60957     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60944     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60921     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60759     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60897     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61518     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60958     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60922     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60937     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60875     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60766     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60751     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60768     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60743     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61076     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60912     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60816     SYN_RECV
Claro ejemplo de SYN Attack al Apache.
2) Mirando el server-status del Apache
Si miramos el server-status del apache veremos conexiones en estado "Reading" ("R" Reading Request).



El problema es que cuando el número de conexiones "Reading" llena el "MaxClients" del Apache no acepta nuevas peticiones, por lo que los nuevos clientes, aunque sean legítimos, no serán aceptados.

Podemos aumentar el valor del "MaxClients" para que no se llene la cola de peticiones y acepte a todos los clientes, sean atacantes o no.

Otra buena medida es bajar el valor del "Timeout" del Apache para que las peticiones "Reading" sean "matadas" rápidamente, antes que pueda llenarse el MaxClients a su tope.

Para aumentar el MaxClients en el Apache 2 basta con añadir la directiva:

ServerLimit 350 antes de MaxClients y ya dejará.


[..]
ServerLimit 500
MaxClients 450
[..]

3) Mirando los logs del mod_evasive
linux escribió:Jun 22 18:24:04 lan mod_evasive[3835]: Blacklisting address 82.228.169.50: possible attack.
Jun 22 18:24:45 lan mod_evasive[3600]: Blacklisting address 81.206.164.163: possible attack.
Jun 22 18:25:46 lan mod_evasive[3589]: Blacklisting address 155.232.250.19: possible attack.
Jun 22 18:27:23 lan mod_evasive[3671]: Blacklisting address 83.227.217.2: possible attack.
Jun 22 18:28:10 lan mod_evasive[3673]: Blacklisting address 68.187.171.89: possible attack.
Jun 22 18:29:57 lan mod_evasive[3605]: Blacklisting address 70.143.2.130: possible attack.
Jun 22 18:30:45 lan mod_evasive[3803]: Blacklisting address 69.157.93.88: possible attack.
Jun 22 18:31:45 lan mod_evasive[10397]: Blacklisting address 146.64.81.22: possible attack.
Jun 22 18:35:01 lan mod_evasive[3794]: Blacklisting address 66.38.192.134: possible attack.
Jun 22 18:35:15 lan mod_evasive[3553]: Blacklisting address 81.190.204.64: possible attack.
Jun 22 18:40:10 lan mod_evasive[16602]: Blacklisting address 64.231.39.129: possible attack.
Jun 22 18:48:04 lan mod_evasive[16479]: Blacklisting address 84.99.195.100: possible attack.
Jun 22 18:48:12 lan mod_evasive[16467]: Blacklisting address 201.0.10.142: possible attack.
Jun 22 18:52:57 lan mod_evasive[16573]: Blacklisting address 219.95.39.242: possible attack.
Jun 22 18:53:07 lan mod_evasive[16534]: Blacklisting address 86.129.3.91: possible attack.
Jun 22 18:53:26 lan mod_evasive[16527]: Blacklisting address 62.254.0.32: possible attack.
Jun 22 18:54:41 lan mod_evasive[30473]: Blacklisting address 24.196.199.191: possible attack.
Jun 22 18:55:17 lan mod_evasive[30520]: Blacklisting address 142.161.157.227: possible attack.
Jun 22 18:55:24 lan mod_evasive[30461]: Blacklisting address 65.92.145.133: possible attack.
Jun 22 18:55:33 lan mod_evasive[30509]: Blacklisting address 88.111.227.200: possible attack.
Jun 22 18:56:13 lan mod_evasive[30473]: Blacklisting address 69.199.94.227: possible attack.
Jun 22 18:57:45 lan mod_evasive[30517]: Blacklisting address 86.125.135.212: possible attack.
Jun 22 18:57:54 lan mod_evasive[30479]: Blacklisting address 84.192.141.65: possible attack.
Jun 22 18:58:46 lan mod_evasive[30527]: Blacklisting address 83.140.97.106: possible attack.
Jun 22 18:59:31 lan mod_evasive[30469]: Blacklisting address 82.173.216.196: possible attack.
Jun 22 19:00:33 lan mod_evasive[30517]: Blacklisting address 80.176.157.245: possible attack.
Jun 22 19:00:38 lan mod_evasive[30470]: Blacklisting address 86.133.102.51: possible attack.
Jun 22 19:01:35 lan mod_evasive[30870]: Blacklisting address 24.42.134.253: possible attack.
Jun 22 19:01:48 lan mod_evasive[30509]: Blacklisting address 62.254.0.34: possible attack.
Jun 22 19:02:57 lan mod_evasive[31009]: Blacklisting address 81.227.219.125: possible attack.
Jun 22 19:03:29 lan mod_evasive[31056]: Blacklisting address 172.209.173.153: possible attack.
Jun 22 19:05:07 lan mod_evasive[31385]: Blacklisting address 84.6.12.110: possible attack.
Jun 22 19:06:52 lan mod_evasive[31008]: Blacklisting address 85.227.144.249: possible attack.
Jun 22 19:06:56 lan mod_evasive[31263]: Blacklisting address 213.222.156.222: possible attack.
Jun 22 19:07:13 lan mod_evasive[31393]: Blacklisting address 62.163.143.166: possible attack.
Jun 22 19:07:37 lan mod_evasive[31021]: Blacklisting address 62.135.101.73: possible attack.
Jun 22 19:08:03 lan mod_evasive[31251]: Blacklisting address 82.201.249.69: possible attack.
Jun 22 19:08:17 lan mod_evasive[31200]: Blacklisting address 81.62.65.53: possible attack.
Jun 22 19:11:04 lan mod_evasive[31263]: Blacklisting address 82.39.148.204: possible attack.
Jun 22 19:12:37 lan mod_evasive[31241]: Blacklisting address 213.222.154.13: possible attack.
Jun 22 19:13:54 lan mod_evasive[31027]: Blacklisting address 81.51.79.4: possible attack.
Jun 22 19:24:04 lan mod_evasive[31041]: Blacklisting address 84.221.118.156: possible attack.
Jun 22 19:48:47 lan mod_evasive[3400]: Blacklisting address 62.135.101.192: possible attack.
Jun 22 19:53:04 lan mod_evasive[31031]: Blacklisting address 62.30.33.13: possible attack.
Jun 22 19:54:32 lan mod_evasive[31016]: Blacklisting address 72.14.194.18: possible attack.
Jun 22 19:56:10 lan mod_evasive[31067]: Blacklisting address 198.96.34.58: possible attack.
Jun 22 20:03:24 lan mod_evasive[5144]: Blacklisting address 172.213.33.242: possible attack.
Jun 22 20:08:31 lan mod_evasive[5137]: Blacklisting address 83.241.11.16: possible attack.
Jun 22 20:21:59 lan mod_evasive[6645]: Blacklisting address 201.23.193.20: possible attack.
Jun 22 20:32:28 lan mod_evasive[7801]: Blacklisting address 212.38.134.172: possible attack.
Jun 22 20:45:46 lan mod_evasive[7836]: Blacklisting address 81.247.11.48: possible attack.
Jun 22 20:48:03 lan mod_evasive[7796]: Blacklisting address 70.245.98.186: possible attack.
Jun 22 20:49:38 lan mod_evasive[7832]: Blacklisting address 61.8.138.203: possible attack.
Jun 22 20:51:21 lan mod_evasive[7801]: Blacklisting address 201.132.197.161: possible attack.
Jun 22 20:57:18 lan mod_evasive[10426]: Blacklisting address 82.201.249.67: possible attack.
Jun 22 20:57:51 lan mod_evasive[7822]: Blacklisting address 81.77.26.162: possible attack.
Jun 22 21:00:25 lan mod_evasive[7817]: Blacklisting address 200.39.202.243: possible attack.
Jun 22 21:12:04 lan mod_evasive[7794]: Blacklisting address 84.27.139.25: possible attack.
Jun 22 21:22:27 lan mod_evasive[7816]: Blacklisting address 217.208.98.254: possible attack.
Si es un DDoS muy distribuido enseguida notaremos que muchas ip's diferente DoSean el Apache.
4) Mirando los logs del syslog (del kernel)
linux escribió:May 17 13:39:01 lan kernel: possible SYN flooding on port 80. Sending cookies.
May 17 13:39:02 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:35 lan kernel: NET: 4 messages suppressed.
May 17 13:39:35 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:38 lan kernel: NET: 1 messages suppressed.
May 17 13:39:38 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:43 lan kernel: NET: 6 messages suppressed.
May 17 13:39:43 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:48 lan kernel: NET: 4 messages suppressed.
May 17 13:39:48 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:52 lan kernel: NET: 9 messages suppressed.
May 17 13:39:52 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:57 lan kernel: NET: 15 messages suppressed.
May 17 13:39:57 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:40:01 lan kernel: possible SYN flooding on port 80. Sending cookies.
Líneas a mirar:
linux escribió:possible SYN flooding on port 80. Sending cookies.
"Sending Cookies" si lo tenemos activado en el /etc/sysctl.conf
# Enable TCP SYN Cookie Protection
Código:

net.ipv4.tcp_syncookies = 1
A veces es mejor deshabilitarlo:
Código:

net.ipv4.tcp_syncookies = 0
De esta manera podemos ver las ip's del ataque:
linux escribió:Jul 14 12:46:50 lan kernel: TCP: drop open request from 80.171.45.81/63069
Jul 14 12:46:55 lan kernel: NET: 1401 messages suppressed.
Jul 14 12:46:55 lan kernel: TCP: drop open request from 80.103.166.148/4403
Jul 14 12:46:59 lan kernel: NET: 1772 messages suppressed.
Jul 14 12:46:59 lan kernel: TCP: drop open request from 200.127.62.215/4019
Jul 14 12:47:05 lan kernel: NET: 2362 messages suppressed.
Jul 14 12:47:05 lan kernel: TCP: drop open request from 85.57.169.142/19899
Jul 14 12:47:11 lan kernel: NET: 2618 messages suppressed.
Jul 14 12:47:11 lan kernel: TCP: drop open request from 83.19.73.122/2710
Jul 14 12:47:14 lan kernel: NET: 898 messages suppressed.
Jul 14 12:47:14 lan kernel: TCP: drop open request from 80.235.39.64/3554
Jul 14 12:47:19 lan kernel: NET: 1120 messages suppressed.
Jul 14 12:47:19 lan kernel: TCP: drop open request from 80.171.45.81/62095
Jul 14 12:47:24 lan kernel: NET: 1714 messages suppressed.
Jul 14 12:47:24 lan kernel: TCP: drop open request from 84.62.152.44/34014
Jul 14 12:47:29 lan kernel: NET: 2274 messages suppressed.
Jul 14 12:47:29 lan kernel: TCP: drop open request from 200.127.62.215/3207
Jul 14 12:47:34 lan kernel: NET: 1552 messages suppressed.
Jul 14 12:47:34 lan kernel: TCP: drop open request from 80.103.166.148/4797
Jul 14 12:47:39 lan kernel: NET: 4044 messages suppressed.
Jul 14 12:47:39 lan kernel: TCP: drop open request from 80.235.39.64/2678
Jul 14 12:47:44 lan kernel: NET: 4360 messages suppressed.
Jul 14 12:47:44 lan kernel: TCP: drop open request from 80.103.166.148/1312
Jul 14 13:04:15 lan kernel: TCP: drop open request from 200.14.237.83/4787
Jul 14 13:04:22 lan kernel: NET: 147 messages suppressed.
Jul 14 13:04:22 lan kernel: TCP: drop open request from 81.38.172.161/4892
Jul 14 13:04:30 lan kernel: NET: 6 messages suppressed.
Jul 14 13:04:30 lan kernel: TCP: drop open request from 200.14.237.83/4934
Jul 14 13:04:30 lan kernel: TCP: drop open request from 200.14.237.83/4935
Jul 14 13:04:38 lan kernel: NET: 76 messages suppressed.
Jul 14 13:04:38 lan kernel: TCP: drop open request from 81.84.212.34/2861
Jul 14 13:04:40 lan kernel: NET: 269 messages suppressed.
Jul 14 13:04:40 lan kernel: TCP: drop open request from 200.14.237.83/3070
Jul 14 13:04:45 lan kernel: NET: 287 messages suppressed.
Jul 14 13:04:45 lan kernel: TCP: drop open request from 81.203.228.102/4400
Jul 14 13:04:50 lan kernel: NET: 98 messages suppressed.
Jul 14 13:04:50 lan kernel: TCP: drop open request from 81.84.212.34/3961
Jul 14 13:04:54 lan kernel: NET: 245 messages suppressed.
Jul 14 13:04:54 lan kernel: TCP: drop open request from 200.84.169.200/1183
Jul 14 13:05:00 lan kernel: NET: 1787 messages suppressed.
Jul 14 13:05:00 lan kernel: TCP: drop open request from 81.203.228.102/2050
Jul 14 13:05:04 lan kernel: NET: 3208 messages suppressed.
Jul 14 13:05:04 lan kernel: TCP: drop open request from 86.212.167.27/4720
Jul 14 13:05:09 lan kernel: NET: 2031 messages suppressed.
Jul 14 13:05:09 lan kernel: TCP: drop open request from 81.203.228.102/1794
Jul 14 13:05:14 lan kernel: NET: 2221 messages suppressed.
Jul 14 13:05:14 lan kernel: TCP: drop open request from 81.38.172.161/4908
Jul 14 13:05:21 lan kernel: NET: 730 messages suppressed.
Jul 14 13:05:21 lan kernel: TCP: drop open request from 81.203.228.102/1430
Jul 14 13:05:25 lan kernel: NET: 234 messages suppressed.
Jul 14 13:05:25 lan kernel: TCP: drop open request from 81.203.228.102/2939
Jul 14 13:05:30 lan kernel: NET: 1594 messages suppressed.
Jul 14 13:05:30 lan kernel: TCP: drop open request from 200.14.237.83/3876
Jul 14 13:05:36 lan kernel: NET: 633 messages suppressed.
Jul 14 13:05:36 lan kernel: TCP: drop open request from 86.212.167.27/1116
Jul 14 13:05:39 lan kernel: NET: 970 messages suppressed.
Jul 14 13:05:39 lan kernel: TCP: drop open request from 81.38.172.161/3040
Jul 14 13:05:45 lan kernel: NET: 548 messages suppressed.
Jul 14 13:05:45 lan kernel: TCP: drop open request from 81.203.228.102/2119
Jul 14 13:05:50 lan kernel: NET: 421 messages suppressed.
Jul 14 13:05:50 lan kernel: TCP: drop open request from 81.203.228.102/2478
Jul 14 13:05:56 lan kernel: NET: 379 messages suppressed.
Jul 14 13:05:56 lan kernel: TCP: drop open request from 81.203.228.102/4005
Jul 14 13:05:59 lan kernel: NET: 891 messages suppressed.
Jul 14 13:05:59 lan kernel: TCP: drop open request from 81.38.172.161/3568
Jul 14 13:06:04 lan kernel: NET: 2221 messages suppressed.
Jul 14 13:06:04 lan kernel: TCP: drop open request from 81.203.228.102/4532
Jul 14 13:06:09 lan kernel: NET: 243 messages suppressed.
Jul 14 13:06:09 lan kernel: TCP: drop open request from 81.203.228.102/1939
Jul 14 13:06:14 lan kernel: NET: 2166 messages suppressed.
Jul 14 13:06:14 lan kernel: TCP: drop open request from 81.38.172.161/2137
Jul 14 13:06:19 lan kernel: NET: 2071 messages suppressed.
Jul 14 13:06:19 lan kernel: TCP: drop open request from 81.38.172.161/3136
Jul 14 13:06:24 lan kernel: NET: 2069 messages suppressed.
Jul 14 13:06:24 lan kernel: TCP: drop open request from 81.84.212.34/4600
Jul 14 13:06:29 lan kernel: NET: 1797 messages suppressed.
Jul 14 13:06:29 lan kernel: TCP: drop open request from 86.212.167.27/3171
Jul 14 13:06:35 lan kernel: NET: 1292 messages suppressed.
Jul 14 13:06:35 lan kernel: TCP: drop open request from 81.203.228.102/1394
Jul 14 13:06:39 lan kernel: NET: 715 messages suppressed.
linux escribió:May 17 14:13:24 lan kernel: ip_conntrack: table full, dropping packet.
Tabla llena. Tenemos un problema porque no admitiremos más conexiones aunque sean legítimas.
Podemos aumentar el valor de dicha tabla si nuestra red da para más.

Directamente:
Código:
echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max
Para que el valor quede guardardo y no se pierda al reiniciar, debemos añadirlo en el sysctl.conf
Código:
net.ipv4.ip_conntrack_max = 65535
Paquetes Marcianos:
linux escribió:Aug 31 12:41:29 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 12:45:07 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 12:52:57 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 12:58:55 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:08:12 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:12:03 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:34:38 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:37:38 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:52:42 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:56:18 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:59:54 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:13:32 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:38:08 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:43:42 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:50:05 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:51:05 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:57:58 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 15:05:27 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 15:06:14 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 15:09:08 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Son paquetes inesperados que llegan por un camino por el cual no pueden llegar indica algún problema de audacia (cracker).
Usando paquetes como éstos se pueden atacar vulnerabilidades remotas en stacks TCP/IP

5) Mirando las gráficas del MRTG, RRDtool
Si ves que el tráfico inbound sube hasta los 100mbps es que te están doseando hehehe.
[Tienes que estar registrado y conectado para ver esa imagen]
avatar
Lorena Wells
RootAdmin
RootAdmin

Puntos : 270
Reputación : 1
Mensajes : 64
Pais Peru


http://team-aportes.foromx.net

Volver arriba Ir abajo

Ver el tema anterior Ver el tema siguiente Volver arriba

- Temas similares

 
Permisos de este foro:
No puedes responder a temas en este foro.