News for hackers. Stuff that matters.

A comment on You don’t want to be on Cloudflare’s naughty list. Parent comment

Re:You don’t want to be on Cloudflare’s naughty list by LinuxBender on Tuesday September 20, 2022 @06:07PM (#32918457)
You are right. I just happen to use a very safe range. If I didn't care about anyone using jumbo frames I could set the range to 1220:1536 and nearly all legit traffic would pass just fine. 1220 (to 13xx) for the people using VPN's and ip6-ip4 gateways. I just try to give really conservative examples so that it is less likely I break someones unusual setup. Anything just over 9k is fine for most jumbo-frame setups.

All of this said, I could set the range to 1:65536 and it would still drop most bots as they don't even bother to set MSS at all in their scans. I'm not sure which tool they are using.

[ Parent | on HN ]
Re:You don’t want to be on Cloudflare’s naughty list by LinuxBender on Tuesday September 27, 2022 @08:53PM (#33003078)
As a follow-up to this, I experimented with dropping any packet that does not have the exact MSS of 1460. Nearly all spam bots and crawlers are gone but I would expect that some people using VPN's would also be blocked.

Oddly enough most of the bots in Asia are exactly 1398 and most of the bots in Russia are 1424. I find that interesting.

[ Parent | on HN ]