Search found 2 matches

by TheBronx
11 Jan 2013, 16:54
Forum: General Discussion (csf)
Topic: [SYN flood attack] how to ban IP blocks if...
Replies: 1
Views: 4016

Re: [SYN flood attack] how to ban IP blocks if...

another idea: save a registry of SYN packets sent from each /24 IP block. Example: 192.132.209.* -> 24 SYN packets 105.75.136.* -> 2 SYN packets 217.160.69.* -> 15 SYN packets ... Every 1 minute (for example) the counter is resetted. If a range reaches 30 packets, the entire /24 block is banned. Why...
by TheBronx
11 Jan 2013, 13:53
Forum: General Discussion (csf)
Topic: [SYN flood attack] how to ban IP blocks if...
Replies: 1
Views: 4016

[SYN flood attack] how to ban IP blocks if...

Hi all. I've been working in mitigating the attacks I'm suffering in my server and now I have a question. Is it possible to block IP ranges (IP blocks) when lets say 4 or more IPs from that block are already banned? Here is a small capture of the traffic on port 80 during the last attack: http://i.i...