Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: The impending DDoS storm

  • From: Aaron Hopkins
  • Date: Wed Aug 13 16:49:44 2003

> has anyone tried tarpitting eg labrea to slow the worm?

I have been using my Linux kernel module ipt_TARPIT (included in the latest
netfilter.org patch-o-matic release) to do this for any IPs on my network
lacking a route, including outbound from my customers and inbound to my
unused address space.

While it is trying to scan routeless IPs, the tarpit slows it down to
scanning 20 IPs per ~9 minutes.  (MSBlast has 20 connection slots, each
apparently timing out after ~9 minutes.)  It normally appears to have a
several second connect timeout, so this slows it down by two orders of
magnitude with a similar drop in network traffic.

                                    -- Aaron





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.