Forum Discussion
Connect_Admin_1
Nimbostratus
NimbostratusDDOS Attack and our LTM 6400
Our website is under a pretty heavy DDOS attack. Ive been through the startup process, and we are able to limit the open connections, however what we are finding is that it's still limiting legitimate connections as well.
It was recommended that I come here and bring this up with the pro's. We are looking for a way to scan and stop the obvious offending inbound traffic based threshold level of connections.
Currently the webserver is on an inside interface of a sonicwall UTM with the 6400 on an outside interface between the sonicwall, and our carriers adtran.
Any input is appreciated, and suggestions welcome.
2 Replies
HamishCirrocumulus
OK.
Have you grid moving the page that the offending traffic is visiting with a simple redirect to a new location? Generally automated DDOS attacks won't follow the redirect... Of course when they do, you'll need to do something else (A small static page with a meta refresh to a new location perhaps?).
Also severely cutback the amount of idle time that open connections can stay connected. Browsers won't care, although it will probably increase your connection rate...
HHi,
Are you still under attack?
Are you able to classify the attack traffic?
Is it all layer 7 (HTTP), or are you receiving layer 4 attacks (syn-floods, etc) as well?
I ask for two reasons:
1. The nature of the attacks will determine the response and
2. I'm collecting data about DDOS attacks for future defenses.
Thanks
