DDoS: Detection and Response

Joon:

 

 

Take a look at the image next to "The Attack". At that point, the system was seeing about 1.7 Million ( 1,700,000) connections.

 

 

You can set Hyenae to send a specific count of attempts with a :

 

 

-c [Min packet count]

 

-C [Max packet count]

 

 

Keep in mind, this test was a standard syn flood. If I am reading right, it sounds like you are actually seeing fully established connections (complete 3way handshake) and then a GET request.

 

 

If that is so, the syn "cookie" protection would not be in play, since the handshake is being completed.

 

 

In the case of a full handshake HTTP GET DoS we'd have to look at the traffic and investigate what identifiable characteristics it has.

 

 

Feel free to ping me if I can help!

 

 

-Josh