bandwidth consumption problem 1

[bluemax72]

Hi guys,
I have got a big problem. My server is under a DDoS attack. The problem is Bandwidth consumption. I am getting useless traffic which is consuming my bandwidth and the HTTP requests are valid. I am using a CISCO Core Router whose model is 7513. The bandwidth capacity which i am recieving is 155 MBPs i.e. T1. My firewall is of PIX. Please help me.

Blue Max

 

[baddos]

You need your ISP to help you. Your T1 will be flooded regardless of your filtering if it's a real DDOS. However, if it's just an application exploit or something like that, you can use the filtering example that Cisco posted for filtering code red.

http://www.cisco.com/warp/public/63/nbar_acl_codered.shtml

 

[bluemax72]

What do you mean by T1 will be flooded regardless of my filtering if it's a real DDOS.

BLUE MAX

 

[baddos]

If it's a real DDOS, the data will flow down your T1 and then get dropped by your router (bandwidth already used). While this protects your server's CPU, it doesn't protect the t1 bandwidth. If this is the case, you need to work with your ISP to help block it at their end to block it before sending it down your t1.

 

[yizhar]

HI.

The pix can limit connections using the static command (or maybe some other commands).
I'm not sure, but maybe it can help you defending the server.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#1026694

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[yizhar]

HI.

Regarding "baddos" post:
> If it's a real DDOS, the data will flow down your T1
It is related to the specific kind of attack, and direction of traffic.
If the bandwidth consumption is for return traffic from your server, then blocking or limitting it can help.

I also suggest involving the ISP in the topic, it can only help and of course blocking the attack at their devices is a good idea if possible.

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar