hi nanog'ers On 03/31/16 at 10:20am, Valdis.Kletnieks@vt.edu wrote:
On Thu, 31 Mar 2016 10:02:05 +0200, "marcel.duregards--- via NANOG" said:
We consider port scan and brute force on ssh port as an attack, and even
...
(For the record, our border routers drop inbound SYN on port 22 on *both* ipv4 and ipv6 address spaces. It's amazing how few brute force attempts we see on our servers... :)
i think the best way, ( imho ) to discourage random incoming ssh connections or anything else ( tcp-based ) is to run tarpit on ALL tcp based ports ... one obviously would allow incoming 25/tcp traffic to mail servers and incoming 80/tcp to web servers, etc etc, but otherwise, all other incoming tcp ports gets unconditionally tarpit'd we used to get hundreds of thousands of garbage tcp connections per minute which basically disappeared after running tarpits as needed and the attackers ( port scanners ) pay a penalty for sending useless packets to tarpit'd ports fail2ban/etc is okay but it's too limited since i want to deny all tcp connections and specifically only allow certain incoming traffic which is trivial to implement with iptables + tarpits /dev/null incoming packets is okay but it still occupied time/space/buffers in the pipe and the attackers didn't feel any pain for sending the packets doing ddos mitigation for your own IP# space is fairly easy to create various policies ... doing the ddos mitigation for your customers down the line using your routers can be tricky business and very messy if either the customer nor isp doesn't change something ( aka more $$$ ) magic pixie dust alvin DDoS-Mitigator.net