On Denial Of Service Attacks By Bryce Whitty At Isnare.com Ezine Articles

I was thinking about this attack pattern after reading about the DDoSattack on theMillion Dollar Homepage. The site's owner was asked for $50,000 in exchange for the attack being halted.

It is clear, to me at least, that steps should be taken to prevent DDoS attempts at some point in the network where the bandwidth can cope. This is, usually, before it hits the destination server. Firewall hardware on the main connection to an ISP is one of the best places to block such attempts, but the problem arises from the distributed nature of these attacks. It is not a matter of blocking a single IP address, or even a single range, and trying to block all of the subnets usually prevents legitimate users accessing the site, which is what the attackers intended all along.

One approach to preventing this would be to detect IP addresses which are repeatedly sending the same data to the same place, such as large ping packets going to the same hosted server, or patterns in the traffic, and selectively block or delay such packets with respect to legitimate packets from IP addresses seen much less frequently, usually characteristic of real site visitors.

Another approach is to drop unwanted packets directly, rather than wasting time and resources replying to those packets, and to prioritise based on protocol - giving HTTP priority over e.g. ICMP.

Of course, this doesn't prevent attacks which utilise a large number of HTTP connections, filling the server's connection pool and preventing other users establishing a link to the server, but there are often modules for the web server software itself which can detect such activity and prioritise traffic, or drop connections which fit a certain characteristic pattern.

Distributed Denial of Service attacks are almost impossible to entirely block or prevent, but measures are easily introduced which can limit their effectiveness. Ultimately, the real source must be determined in order to stop such an attack, but this usually means tracing connections back through several computers which have been used without the owner's knowledge, usually by means of remote control software installed silently. Performing such a trace is difficult at best, and even authorities struggle to reach the end of the chain and determine the real source.

Published At: Isnare Free Articles Directory http://www.isnare.com
Permanent Link: http://www.isnare.com/?aid=52143&ca=Computers+and+Technology

Important Notice DISCLAIMER: All information, content, and data in this article are sole opinions and/or findings of the individual user or organization that registered and submitted this article at Isnare.com without any fee. The article is strictly for educational or entertainment purposes only and should not be used in any way, implemented or applied without consultation from a professional. We at Isnare.com do not, in anyway, contribute or include our own findings, facts and opinions in any articles presented in this site. Publishing this article does not constitute Isnare.com's support or sponsorship for this article. Isnare.com is an article publishing service. Please read our Terms of Service for more information.