|
I have a linux webhosting server which attracts DDOS attacks. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from them. I know there are many factors should you know before you choose the suitable hardware firewall like the amount of this DDOS and pps ..etc Please suggest a linux tools to measure those factors and to help me collect the required informations ( pps - amount of DDOS - concurrent connections and other factors ). |
|||||
|
|
Let's step back a bit... DDoS attacks involve hundreds or thousands of zombie machines on the internet that send traffic at your machine (usually faster than the server OR your ISP uplinks can process). The important piece here is that thousands of zombies sending traffic at your machine can consume 50Mpbs or a lot more, depending on the attack. If that DDoS traffic is more than your ISP bandwidth, no firewall on the planet can help you. You have to work with your upstream providers to track down the sources and shut down their traffic. This can take days. Some people attempt to use DNS to solve this problem (by using NAT from multiple providers and changing their DNS A record during an attack); this is not always the best solution, since the zombies often re-resolve DNS every so often to be sure they are hitting the right target. If you are simply handling DDoS situations that are smaller than your ISP uplink, then buy the Cisco ASA that can handle the bandwidth of the ISP uplink you have. |
|||
|
|
