News for hackers. Stuff that matters.

A comment on A Linux botnet is launching crippling DDoS attacks in excess of 150Gbps. Parent comment

Re:A Linux botnet is launching crippling DDoS attacks in exc... by voltagex_ on Wednesday September 30, 2015 @03:48AM (#10302397)
Would you consider fail2ban in this case?
[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by msl09 on Wednesday September 30, 2015 @08:19AM (#10303336)
"Warning: Using an IP blacklist will stop trivial attacks but it relies on an additional daemon and successful logging (the partition containing /var can become full, especially if an attacker is pounding on the server). Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. SSH keys provide an elegant solution to the problem of brute forcing without these problems."

source: https://wiki.archlinux.org/index.php/Fail2ban

[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by justinsaccount on Wednesday September 30, 2015 @09:19AM (#10303671)
> Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server.

No they can't. That is not how TCP works.

[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by voltagex_ on Wednesday September 30, 2015 @10:24AM (#10304167)
From memory, you can spoof UDP but not TCP.

https://serverfault.com/a/153619/91708

[ Parent | on HN ]