-2

最近几天我的服务器遭受了这种攻击：（带宽> 60MBit / s，XXX.XXX.XXX.XXX是多个IP）

    tcpdump -n proto ICMP    
    17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36
    17:15:19.325217 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36
    17:15:19.345561 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 56
    17:15:19.484865 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36
    17:15:19.529616 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36
    17:15:19.957058 IP XXX.XXX.XXX.XXX > my_ip: ICMP YYY.YYY.YYY.YYY tcp port 39692 unreachable, length 36
    17:15:19.968957 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 56
    17:15:20.112520 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 56
    17:15:20.203199 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 36
    17:15:20.204803 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 36

我有 FreeBSD 9.1，我的 pf.conf 是

ext_if="em0"
table <blockedips> persist file "/etc/pf-blocked-ips.conf"

set skip on lo0

block drop in log (all) quick on $ext_if from <blockedips> to any

block in
pass out flags S/SA keep state

pass in on $ext_if proto tcp to port 80 flags S/SA keep state
pass in on $ext_if proto tcp to port ssh flags S/SA synproxy state

有什么我可以用 pf 做的吗？

4

1 回答 1

0

看起来您可能会收到来自 ddos​​ 攻击的一些反向散射（http://blog.usu.edu/security/2010/08/24/backscatters-the-name-dos-the-game/）。

除非您可以在它们到达您的服务器之前在交换机中过滤它们，否则您对此无能为力；它们已经作为网络异常被丢弃在内核中。

于 2013-04-23T15:45:16.447 回答