Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux webhosting server which attracts DDOS attacks. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from them. I know there are many factors should you know before you choose the suitable hardware firewall like the amount of this DDOS and pps ..etc

Please suggest a linux tools to measure those factors and to help me collect the required informations ( pps - amount of DDOS - concurrent connections and other factors ).

share|improve this question
What is the end goal of buying the ASA? That your linux server will continue serving traffic to the internet? – Mike Pennington Jun 4 '12 at 17:28
@MikePennington I have a webhosting server which has a high DDOS. And i don't know what is the factors should i know to buy the suitable cisco firewall for this server. – linuxcore Jun 4 '12 at 17:32
up vote 1 down vote accepted

Let's step back a bit...

DDoS attacks involve hundreds or thousands of zombie machines on the internet that send traffic at your machine (usually faster than the server OR your ISP uplinks can process).

The important piece here is that thousands of zombies sending traffic at your machine can consume 50Mpbs or a lot more, depending on the attack. If that DDoS traffic is more than your ISP bandwidth, no firewall on the planet can help you. You have to work with your upstream providers to track down the sources and shut down their traffic. This can take days.

Some people attempt to use DNS to solve this problem (by using NAT from multiple providers and changing their DNS A record during an attack); this is not always the best solution, since the zombies often re-resolve DNS every so often to be sure they are hitting the right target.

If you are simply handling DDoS situations that are smaller than your ISP uplink, then buy the Cisco ASA that can handle the bandwidth of the ISP uplink you have.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.