2

Newroz Telecom (an ISP) is using an exit node (or gateway) for each city they operate in. That is all the users in city A is sharing one public IP (when the users go to a website to show their IP they all get the same result).

I am having DDOS attacks that is coming from a user/users of this ISP, blocking the IP will mean blocking the entire city, how can i fight DDOS in such environment ?

Best regards,

zertux
  • 151

1 Answers1

1

Here are a few options:

Can you TCPDump the traffic and maybe find a packet that is the ddos packet string and block it?

In all honesty, the only way this will probably be fixable is to ask the ISP to check and find the abuser.

Tiffany Walker
  • 6,691
  • The attack have stopped (for now) and i am out of the office so i cant run your request at the moment, but can you explain more about blocking the packet string ? What do you mean ? Wont that be just like blocking the public ip ? Or do you mean check the packets and drop the malicious ones ? – zertux Jul 04 '13 at 16:52
  • Packets contain TTL, Strings, and other information. You can use IPTables to block certain packets based on certain contents. This can work in situations the attackers packets are the same. – Tiffany Walker Jul 04 '13 at 20:57
  • I see, do you reommend any readings on this ? Books, tutorials ? – zertux Jul 04 '13 at 22:01
  • I would man TCPDump and look up TCPDump. – Tiffany Walker Jul 04 '13 at 22:26