SlideShare a Scribd company logo

PLNOG 17 - Patryk Wojtachnio - DDoS mitygacja oraz ochrona sieci w środowisku szeroko uwielbianego WordPress'a :)

•
•
PROIDEA
PROIDEA

Kazdy z nas w dobie obecnego Internetu i Pokemon Go ma swoja stronę internetowa, forum czy tez prowadzi sklep e-commerce. Z punktu widzenia klienta, rozwiązanie jest proste. Loguje się na swoje konto, uruchamia instalator CMS i zaczyna prowadzić swoje usługi bądź tez dostarczać treści. Będzie to pierwsze case study skutecznej obrony przed potężnymi atakami wolumetrycznymi mające na celu wyłącznie usług HTTP bądź HTTPS za pomocą wysyłania dużej ilości pakietów SYN na serwer który hostuje zainfekowana stronę www. Celem prezentacji jest pokazanie mechanizmu obrony przed szeroko znanego problemu jakim jestDDoS, metody mitygacji, blackholing oraz przykładowe scenariusze w raz z konfiguracja w oparciu o dystrybucje CentOS oraz modułu HAProxy.

Technology
1 of 54
Download to read offline
DDOS MITYGACJA ORAZ OCHRONA SIECI W ŚRODOWISKU SZEROKO UWIELBIANEGO WORDPRESS'A :) Patryk Wojtachnio
ABOUT ME  Network Engineer at Fasthosts Internet Ltd (1&1 Group).  Previously Network & Security Engineer at PGE, MF, AtoS  IT Tech & Home Data Center blog owner (virtualolivia.com)  Bike Trial Rider & Car Movie Producer (rufzor.com)  Administrator of CCIE.PL board
ABOUT CCIE.PL  The biggest Cisco community in Europe  Over 8300 users  Strong staff  3 general admins  1 board admin  3 servers admins  3 moderators  Over 60 polish CCIEs as members  over 20 of them actively posting!  About 100 new topics per month  About 800 posts per month  English section available
AGENDA  General overview  DDoS categories  Mitigation  DDoS as a Service  Why WordPress ?  How to defend?  UK vs Polish law  Web hosting – case study   Network topology  UDP mitigation  TCP mitigation – Scrubbing Center
DDOS CATEGORIES  Volumetric  Flood-based attacks that can be at layer 3, 4, or 7  Asymmetric  Attacks designed to invoke timeouts or session-state changes  Computational  Attacks designed to consume CPU and memory  Vulnerability-based  Attacks that exploit software vulnerabilities reference f5.com
MITIGATION  Volumetric  Cloud-Based Scrubbing Service, Web Application Firewall  Asymmetric  Web Application Firewall  Computational  Application Delivery Controller Network Firewall  Vulnerability-based  IP Reputation Database Intrusion Prevention/Detection Systems (IDS/IPS), Application Delivery Controller reference f5.com
MITIGATION  Layer 1/2  Cut cables, Jamming, EMP, MAC spoofing & flood  Layer 3  Floods (ICMP)  IP fragments (TCP fragmentation)  Layer 4  SYN, RST, FIN flood  Layer 5  Slowris  Layer 6  XML  Layer 7  SPAM, DNS queries reference f5.com
DDOS AS A SERVICE (DDOS AAS)
DDOS AAS
DDOS AAS
DDOS AAS reference digitalattackmap.com
WHY WORDPRESS ?
WHY WORDPRESS?  Most popular content management system  Require on-demand plugin update  Free  Vulnerability plugins
HOW TO DEFEND ?
THERE IS NO UNIVERSAL SOLUTIONS, THE DEFENCE OF OUR OWN INFRASTRUCTURE IS A WAY OF THINKING, BEING A GOOD STRATEGIST, AWARE OF THE WEAKNESSES AND STRENGTHS
HOW WE WILL MEASURE THE IMPACT ON OUR INFRASTRUCTURE, AND HOW DOES THAT RELATIONSHIP WITH OUR CUSTOMERS?
MONEY DECISION KNOWLEDGE
I DO NOT NEED PROTECTION? WHY?  Customer side  Impact ?  Am I ready to loose my customers ?  Data corruption ?  Reputation – Haters gona hate ?  $$$  Hosting provider  More wider look at the issue - think global  Business impact  SLA / ETR ?  Political - Hacktivism
WHY NOC IS SO IMPORTANT ?  Incident management  Tools (Network Anomalies, Time changes)  24/7  Processes & Escalation  Standby Engineer always on call  First point of contact
WHY NOC IS SO IMPORTANT ? - TOOLS  Focus on real data  Cacti  Netstat  Tcpdump  Wireshark  FlowViewer / Flow Grapher
UK VS POLISH LAW
UK VS POLISH LAW reference http://www.legislation.gov.uk/ukpga/2006/48 http://www.legislation.gov.uk/ukpga/1990/18/section/3 http://isap.sejm.gov.pl/DetailsServlet?id=WDU19970880553
CASE STUDY  Network topology  UDP mitigation  TCP mitigation  Blackholing
R1 R2 DIST1 DIST2 SC2 SC1 SW1 SCRUBBING CENTER INTERFACE PORT-CHANNEL 4X40 GB VPC
CASE STUDY – UDP MITIGATION – DNS  DNS Amplification  Small look-up query  Asymmetrical  Saturate network bandwidth capacity  DNS Flood  Saturate hardware side (Memory, RAM, CPU etc…  Symmetrical  Generated by script on compromised botnet machines
CASE STUDY – UDP MITIGATION – DNS REFLECTION
CASE STUDY – UDP MITIGATION – FRAGMENTS
R1 R2 DIST1 DIST2 SW1 ip access-list extended OUTSIDE-ACL
CASE STUDY – UDP MITIGATION – SAMPLE ACL IP ACCESS-LIST EXTENDED OUTSIDE-ACL 1 DENY UDP ANY HOST X.X.X.X 2 DENY UDP ANY HOST X.X.X.X FRAGMENTS 3 DENY UDP ANY EQ 53 HOST X.X.X.X 4 DENY UDP ANY EQ 4444 HOST X.X.X.X
CASE STUDY – TCP MITIGATION
CASE STUDY – TCP THREE WAY HANDSHAKE
WWW.CCIE.PL BACKBONE DIST SW INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INNCOMMING TCP SYN FLOOD ON PORT 80 SIZE 100 GBPS
WWW.CCIE.PL BACKBONE DIST SW INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INNCOMMING TCP SYN FLOOD ON PORT 80 SIZE 100 GBPS CUSTOMER IMPACT: 1000 CUSTOMER DOMAINS: 3000
SYN FLOOD  How it works ?  Think3-way handshake  Host has a number of incoming free slots  When slots are full no more connections are accepted
SYN FLOOD
SYN FLOOD
WWW.CCIE.PL WWW.RUFZOR.COM WWW.COMPANY.PL
WWW.CCIE.PL BACKBONE DIST SW INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
WWW.CCIE.PL BACKBONE DIST SC SW RFC1918 INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.1/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
WWW.CCIE.PL BACKBONE DIST SC SW RFC1918 INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.1/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
CASE STUDY – WORDPRESS VS HAPROXY  ACL  TCP SYN, Flood free  XMLRPC Brute Force Amplification  NGINX support  GREP & AWK knowledge required
CASE STUDY – HAPROXY SAMPLE CONFIGURATION defaults log global timeout http-request 5s timeout queue 1m timeout connect 10s timeout client 30s timeout server 10s timeout check 10s option httplog timeout connect 5000 option httpchk maxconn 30000 timeout http-request 5s option httpclose retries 2 listen live_http_nginx_nodes bind 0.0.0.0:80 tcp-request inspect-delay 10s tcp-request content accept if HTTP
CASE STUDY – HAPROXY SAMPLE CONFIGURATION - SLOWRIS /etc/haproxy/haproxy.cfg defaults option http-server-close mode http timeout http-request 5s timeout connect 5s timeout server 10s timeout client 30s  Will send slowly requests (header by header)  Will be waiting long time between each of them  It tells HAproxy to let five seconds to a clients to send its whole HTTP Request  Otherwise HAproxy will close connection
CASE STUDY – HAPROXY CONFIGURATION - ACL # acl host_ccie(host) -i ccie.pl www.ccie.pl # acl allowed hdr(host) -i www.ccie.pl www.ccie.pl acl wplogin path_beg /wp-login.php acl xmlrpc_path path_end /xmlrpc.php # acl wplogin_rewrite path_beg /wp-log-me-in # http-request set-path /wp-login.php if wplogin_rewrite # http-request deny if host_singeply http-request deny if xmlrpc_path # http-request deny if !allowed
CASE STUDY – HAPROXY
WWW.CCIE.PL BACKBONE DIST SC SW RFC1918 INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.1/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
THIS IS NOT ALL…  DNS Amplification  DNS Flood  HTTP Flood  IP Fragmentation Attack  NTP Amplification  Ping of Death  Ping Flood  R-U-Dead-Yet  Slowloris  Smurf Attack  SNMP Reflection  SYN Flood  UDP Flood https://pl.wikipedia.org/wiki/Nycticebus Nycticebus – rodzaj małpiatek z rodziny lorisowatych, obejmujący gatunki występujące w południowej Azji.
CASE STUDY – BLACKHOLING IP ACCESS-LIST EXTENDED OUTSIDE-ACL 1 DENY TCP HOST X.X.X.X EQ 80 ANY
SUMMARIZE IT…
QUESTIONS?
THANK YOU /in/pwojtachnio

Recommended

Dns tunnelling its all in the name
Dns tunnelling its all in the nameDns tunnelling its all in the name
Dns tunnelling its all in the name
Security BSides London
 
internet applications
internet applications internet applications
internet applications
Srinivasa Rao
 
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)
Igalia
 
DNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense VectorDNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense Vector
Positive Hack Days
 
08 tcp-dns
08 tcp-dns08 tcp-dns
08 tcp-dns
pantu_1961
 
Ddos and mitigation methods.pptx
Ddos and mitigation methods.pptxDdos and mitigation methods.pptx
Ddos and mitigation methods.pptx
Ozkan E
 
Building an Automated Behavioral Malware Analysis Environment using Free and ...
Building an Automated Behavioral Malware Analysis Environment using Free and ...Building an Automated Behavioral Malware Analysis Environment using Free and ...
Building an Automated Behavioral Malware Analysis Environment using Free and ...Jim Clausing
 
Introduzione ai network penetration test secondo osstmm
Introduzione ai network penetration test secondo osstmmIntroduzione ai network penetration test secondo osstmm
Introduzione ai network penetration test secondo osstmm
Simone Onofri
 

Recommended

Dns tunnelling its all in the name
Dns tunnelling its all in the nameDns tunnelling its all in the name
Dns tunnelling its all in the name
Security BSides London
 
internet applications
internet applications internet applications
internet applications
Srinivasa Rao
 
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)
DIY Internet: Snappy, Secure Networking with MinimaLT (JSConf EU 2013)
Igalia
 
DNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense VectorDNS как линия защиты/DNS as a Defense Vector
DNS как линия защиты/DNS as a Defense Vector
Positive Hack Days
 
08 tcp-dns
08 tcp-dns08 tcp-dns
08 tcp-dns
pantu_1961
 
Ddos and mitigation methods.pptx
Ddos and mitigation methods.pptxDdos and mitigation methods.pptx
Ddos and mitigation methods.pptx
Ozkan E
 
Building an Automated Behavioral Malware Analysis Environment using Free and ...
Building an Automated Behavioral Malware Analysis Environment using Free and ...Building an Automated Behavioral Malware Analysis Environment using Free and ...
Building an Automated Behavioral Malware Analysis Environment using Free and ...Jim Clausing
 
Introduzione ai network penetration test secondo osstmm
Introduzione ai network penetration test secondo osstmmIntroduzione ai network penetration test secondo osstmm
Introduzione ai network penetration test secondo osstmm
Simone Onofri
 
Compression Oracle Attacks on VPN Networks
Compression Oracle Attacks on VPN NetworksCompression Oracle Attacks on VPN Networks
Compression Oracle Attacks on VPN Networks
Priyanka Aash
 
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
FrancisJeremiah1
 
network security
network securitynetwork security
network security
Srinivasa Rao
 
Ddos and mitigation methods.pptx (1)
Ddos and mitigation methods.pptx (1)Ddos and mitigation methods.pptx (1)
Ddos and mitigation methods.pptx (1)
btpsec
 
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
OpenDNS
 
DNSSEC - Domain Name System Security Extensions
DNSSEC - Domain Name System Security ExtensionsDNSSEC - Domain Name System Security Extensions
DNSSEC - Domain Name System Security Extensions
Peter R. Egli
 
Copy of a simple tcp spoofing attack
Copy of a simple tcp spoofing attackCopy of a simple tcp spoofing attack
Copy of a simple tcp spoofing attackVishal Gurujuwada
 
5.Dns Rpc Nfs
5.Dns Rpc Nfs5.Dns Rpc Nfs
5.Dns Rpc Nfsphanleson
 
5.Dns Rpc Nfs 2
5.Dns Rpc Nfs 25.Dns Rpc Nfs 2
5.Dns Rpc Nfs 2phanleson
 
APNIC Hackathon IPv4 & IPv6 security & threat comparisons
APNIC Hackathon IPv4 & IPv6 security & threat comparisonsAPNIC Hackathon IPv4 & IPv6 security & threat comparisons
APNIC Hackathon IPv4 & IPv6 security & threat comparisons
Siena Perry
 
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 FinalExploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 Finalmasoodnt10
 
Practical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacksPractical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacks
Security Session
 
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Threat hunting != Throwing arrow! Hunting for adversaries in your it environmentThreat hunting != Throwing arrow! Hunting for adversaries in your it environment
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Nahidul Kibria
 
Stu r33 b (2)
Stu r33 b (2)Stu r33 b (2)
Stu r33 b (2)SelectedPresentations
 
Bleeding secrets
Bleeding secretsBleeding secrets
Bleeding secrets
Ofer Rivlin, CISSP
 
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...OpenDNS
 
Type of DDoS attacks with hping3 example
Type of DDoS attacks with hping3 exampleType of DDoS attacks with hping3 example
Type of DDoS attacks with hping3 example
Himani Singh
 
internet applications
internet applications internet applications
internet applications
Srinivasa Rao
 
Seven Grades of Perfect Forward Secrecy
Seven Grades of Perfect Forward SecrecySeven Grades of Perfect Forward Secrecy
Seven Grades of Perfect Forward Secrecy
Oleg Gryb
 
CEH v9 cheat sheet notes Certified Ethical Hacker
CEH v9 cheat sheet notes Certified Ethical HackerCEH v9 cheat sheet notes Certified Ethical Hacker
CEH v9 cheat sheet notes Certified Ethical Hacker
David Sweigert
 
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PROIDEA
 
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PROIDEA
 

More Related Content

What's hot

Compression Oracle Attacks on VPN Networks
Compression Oracle Attacks on VPN NetworksCompression Oracle Attacks on VPN Networks
Compression Oracle Attacks on VPN Networks
Priyanka Aash
 
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
FrancisJeremiah1
 
network security
network securitynetwork security
network security
Srinivasa Rao
 
Ddos and mitigation methods.pptx (1)
Ddos and mitigation methods.pptx (1)Ddos and mitigation methods.pptx (1)
Ddos and mitigation methods.pptx (1)
btpsec
 
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
OpenDNS
 
DNSSEC - Domain Name System Security Extensions
DNSSEC - Domain Name System Security ExtensionsDNSSEC - Domain Name System Security Extensions
DNSSEC - Domain Name System Security Extensions
Peter R. Egli
 
Copy of a simple tcp spoofing attack
Copy of a simple tcp spoofing attackCopy of a simple tcp spoofing attack
Copy of a simple tcp spoofing attackVishal Gurujuwada
 
5.Dns Rpc Nfs
5.Dns Rpc Nfs5.Dns Rpc Nfs
5.Dns Rpc Nfsphanleson
 
5.Dns Rpc Nfs 2
5.Dns Rpc Nfs 25.Dns Rpc Nfs 2
5.Dns Rpc Nfs 2phanleson
 
APNIC Hackathon IPv4 & IPv6 security & threat comparisons
APNIC Hackathon IPv4 & IPv6 security & threat comparisonsAPNIC Hackathon IPv4 & IPv6 security & threat comparisons
APNIC Hackathon IPv4 & IPv6 security & threat comparisons
Siena Perry
 
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 FinalExploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 Finalmasoodnt10
 
Practical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacksPractical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacks
Security Session
 
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Threat hunting != Throwing arrow! Hunting for adversaries in your it environmentThreat hunting != Throwing arrow! Hunting for adversaries in your it environment
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Nahidul Kibria
 
Bleeding secrets
Bleeding secretsBleeding secrets
Bleeding secrets
Ofer Rivlin, CISSP
 
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...OpenDNS
 
Type of DDoS attacks with hping3 example
Type of DDoS attacks with hping3 exampleType of DDoS attacks with hping3 example
Type of DDoS attacks with hping3 example
Himani Singh
 
internet applications
internet applications internet applications
internet applications
Srinivasa Rao
 
Seven Grades of Perfect Forward Secrecy
Seven Grades of Perfect Forward SecrecySeven Grades of Perfect Forward Secrecy
Seven Grades of Perfect Forward Secrecy
Oleg Gryb
 
CEH v9 cheat sheet notes Certified Ethical Hacker
CEH v9 cheat sheet notes Certified Ethical HackerCEH v9 cheat sheet notes Certified Ethical Hacker
CEH v9 cheat sheet notes Certified Ethical Hacker
David Sweigert
 

What's hot (20)

Compression Oracle Attacks on VPN Networks
Compression Oracle Attacks on VPN NetworksCompression Oracle Attacks on VPN Networks
Compression Oracle Attacks on VPN Networks
 
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
Mitigating DNS Amplification Attacks At The DNS Server Using BGP AS Paths and...
 
network security
network securitynetwork security
network security
 
Ddos and mitigation methods.pptx (1)
Ddos and mitigation methods.pptx (1)Ddos and mitigation methods.pptx (1)
Ddos and mitigation methods.pptx (1)
 
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...
 
DNSSEC - Domain Name System Security Extensions
DNSSEC - Domain Name System Security ExtensionsDNSSEC - Domain Name System Security Extensions
DNSSEC - Domain Name System Security Extensions
 
Copy of a simple tcp spoofing attack
Copy of a simple tcp spoofing attackCopy of a simple tcp spoofing attack
Copy of a simple tcp spoofing attack
 
5.Dns Rpc Nfs
5.Dns Rpc Nfs5.Dns Rpc Nfs
5.Dns Rpc Nfs
 
5.Dns Rpc Nfs 2
5.Dns Rpc Nfs 25.Dns Rpc Nfs 2
5.Dns Rpc Nfs 2
 
APNIC Hackathon IPv4 & IPv6 security & threat comparisons
APNIC Hackathon IPv4 & IPv6 security & threat comparisonsAPNIC Hackathon IPv4 & IPv6 security & threat comparisons
APNIC Hackathon IPv4 & IPv6 security & threat comparisons
 
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 FinalExploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
Exploiting Network Protocols To Exhaust Bandwidth Links 2008 Final
 
Practical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacksPractical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacks
 
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Threat hunting != Throwing arrow! Hunting for adversaries in your it environmentThreat hunting != Throwing arrow! Hunting for adversaries in your it environment
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
 
Stu r33 b (2)
Stu r33 b (2)Stu r33 b (2)
Stu r33 b (2)
 
Bleeding secrets
Bleeding secretsBleeding secrets
Bleeding secrets
 
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
 
Type of DDoS attacks with hping3 example
Type of DDoS attacks with hping3 exampleType of DDoS attacks with hping3 example
Type of DDoS attacks with hping3 example
 
internet applications
internet applications internet applications
internet applications
 
Seven Grades of Perfect Forward Secrecy
Seven Grades of Perfect Forward SecrecySeven Grades of Perfect Forward Secrecy
Seven Grades of Perfect Forward Secrecy
 
CEH v9 cheat sheet notes Certified Ethical Hacker
CEH v9 cheat sheet notes Certified Ethical HackerCEH v9 cheat sheet notes Certified Ethical Hacker
CEH v9 cheat sheet notes Certified Ethical Hacker
 

Viewers also liked

PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PROIDEA
 
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PROIDEA
 
PLNOG 17 - Tomás Strašák - Latencja jest decydentem
PLNOG 17 - Tomás Strašák - Latencja jest decydentemPLNOG 17 - Tomás Strašák - Latencja jest decydentem
PLNOG 17 - Tomás Strašák - Latencja jest decydentem
PROIDEA
 
PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...
PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...
PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...
PROIDEA
 
PLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firma
PLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firmaPLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firma
PLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firma
PROIDEA
 
PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...
PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...
PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...
PROIDEA
 
PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...
PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...
PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...
PROIDEA
 
PLNOG 17 - Grzegorz Kornacki - F5 and OpenStack
PLNOG 17 - Grzegorz Kornacki - F5 and OpenStackPLNOG 17 - Grzegorz Kornacki - F5 and OpenStack
PLNOG 17 - Grzegorz Kornacki - F5 and OpenStack
PROIDEA
 
PLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEA
PLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEAPLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEA
PLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEA
PROIDEA
 
PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...
PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...
PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...
PROIDEA
 
PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?
PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?
PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?
PROIDEA
 
PLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFX
PLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFXPLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFX
PLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFX
PROIDEA
 
PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...
PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...
PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...
PROIDEA
 
PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...
PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...
PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...
PROIDEA
 
PLNOG 17 - Elisa Jasinska - Network Automation - Design your Systems
PLNOG 17 - Elisa Jasinska - Network Automation - Design your SystemsPLNOG 17 - Elisa Jasinska - Network Automation - Design your Systems
PLNOG 17 - Elisa Jasinska - Network Automation - Design your SystemsPROIDEA
 
PLNOG 17 - Marek Janik - Sieć dla IXP
PLNOG 17 - Marek Janik - Sieć dla IXPPLNOG 17 - Marek Janik - Sieć dla IXP
PLNOG 17 - Marek Janik - Sieć dla IXP
PROIDEA
 
PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...
PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...
PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...
PROIDEA
 
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWSPLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PROIDEA
 
PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...
PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...
PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...
PROIDEA
 
PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...
PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...
PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...
PROIDEA
 

Viewers also liked (20)

PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
PLNOG 17 - Piotr Gruszczyński - Mobile Fronthaul - ewolucja (a może i rewoluc...
 
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
PLNOG 17 - Piotr Zbrzyzny - Zasilanie gwarantowane kluczem stabilności infras...
 
PLNOG 17 - Tomás Strašák - Latencja jest decydentem
PLNOG 17 - Tomás Strašák - Latencja jest decydentemPLNOG 17 - Tomás Strašák - Latencja jest decydentem
PLNOG 17 - Tomás Strašák - Latencja jest decydentem
 
PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...
PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...
PLNOG 17 - Dominik Bocheński, Łukasz Walicki - Zapomnij o VPS - nadeszła era ...
 
PLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firma
PLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firmaPLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firma
PLNOG 17 - Michał Rosiak - Świadomy Klient to bezpieczna firma
 
PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...
PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...
PLNOG 17 - Emil Gągała - DMZ po nowemu - krok po kroku - jak uruchomić SDN w ...
 
PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...
PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...
PLNOG 17 - Sebastian Pasternacki - W poszukiwaniu pięciu dziewiątek – wysoka ...
 
PLNOG 17 - Grzegorz Kornacki - F5 and OpenStack
PLNOG 17 - Grzegorz Kornacki - F5 and OpenStackPLNOG 17 - Grzegorz Kornacki - F5 and OpenStack
PLNOG 17 - Grzegorz Kornacki - F5 and OpenStack
 
PLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEA
PLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEAPLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEA
PLNOG 17 - Bartosz Musznicki - Mobilne i domowe hotspoty Wi-Fi w INEA
 
PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...
PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...
PLNOG 17 - Shabbir Ahmad - Dell Open Networking i Big Monitoring Fabric: unik...
 
PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?
PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?
PLNOG 17 - Robert Ślaski - Jak nie zostać bezrobotnym sieciowcem?
 
PLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFX
PLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFXPLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFX
PLNOG 17 - Sławomir Janukowicz - NFV – using Juniper vMX, vSRX and NFX
 
PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...
PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...
PLNOG 17 - Łukasz Dorosz - Architektura Hybrydowa, jak połączyć własne data c...
 
PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...
PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...
PLNOG 17 - Rafał Wiosna - Euro 2016 -- case study (prawdopodobnie) największy...
 
PLNOG 17 - Elisa Jasinska - Network Automation - Design your Systems
PLNOG 17 - Elisa Jasinska - Network Automation - Design your SystemsPLNOG 17 - Elisa Jasinska - Network Automation - Design your Systems
PLNOG 17 - Elisa Jasinska - Network Automation - Design your Systems
 
PLNOG 17 - Marek Janik - Sieć dla IXP
PLNOG 17 - Marek Janik - Sieć dla IXPPLNOG 17 - Marek Janik - Sieć dla IXP
PLNOG 17 - Marek Janik - Sieć dla IXP
 
PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...
PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...
PLNOG 17 - Piotr Jabłoński - Jak zwiększyć bezpieczeństwo w Data Center? Demo...
 
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWSPLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
 
PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...
PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...
PLNOG 17 - Dawid Królica, Piotr Szołkowski - ExtremeCloud czyli infrastruktur...
 
PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...
PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...
PLNOG 17 - Sebastian Mikołajczyk - Wymiana silnika w aucie sportowym podczas ...
 

Similar to PLNOG 17 - Patryk Wojtachnio - DDoS mitygacja oraz ochrona sieci w środowisku szeroko uwielbianego WordPress'a :)

Practical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacksPractical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacks
Martin Holovský
 
AusNOG 2016 - The Trouble with NAT
AusNOG 2016 - The Trouble with NATAusNOG 2016 - The Trouble with NAT
AusNOG 2016 - The Trouble with NATMark Smith
 
Cloudflare lower network latency = faster website loads
Cloudflare lower network latency = faster website loadsCloudflare lower network latency = faster website loads
Cloudflare lower network latency = faster website loads
Vu Long Tran
 
Testing High Performance Firewalls
Testing High Performance FirewallsTesting High Performance Firewalls
Testing High Performance Firewalls
Ixia
 
Multi-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation StrategiesMulti-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation Strategies
Logan Best
 
Multi-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation StrategiesMulti-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation Strategies
Sagi Brody
 
Helen Tabunshchyk "Handling large amounts of traffic on the Edge"
Helen Tabunshchyk "Handling large amounts of traffic on the Edge"Helen Tabunshchyk "Handling large amounts of traffic on the Edge"
Helen Tabunshchyk "Handling large amounts of traffic on the Edge"
Fwdays
 
Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...
Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...
Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...
Ontico
 
Network tunneling techniques
Network tunneling techniquesNetwork tunneling techniques
Network tunneling techniques
inbroker
 
PLNOG16: Usługi w sieciach operatorskich, Marcin Aronowski
PLNOG16: Usługi w sieciach operatorskich, Marcin AronowskiPLNOG16: Usługi w sieciach operatorskich, Marcin Aronowski
PLNOG16: Usługi w sieciach operatorskich, Marcin Aronowski
PROIDEA
 
Primer to Browser Netwroking
Primer to Browser NetwrokingPrimer to Browser Netwroking
Primer to Browser Netwroking
Shuya Osaki
 
Realtime Detection of DDOS attacks using Apache Spark and MLLib
Realtime Detection of DDOS attacks using Apache Spark and MLLibRealtime Detection of DDOS attacks using Apache Spark and MLLib
Realtime Detection of DDOS attacks using Apache Spark and MLLib
Ryan Bosshart
 
Denial of services : limiting the threat
Denial of services : limiting the threatDenial of services : limiting the threat
Denial of services : limiting the threat
SensePost
 
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...
confluent
 
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...
confluent
 
Layer one 2011-gh0stwood-d-dos-attacks
Layer one 2011-gh0stwood-d-dos-attacksLayer one 2011-gh0stwood-d-dos-attacks
Layer one 2011-gh0stwood-d-dos-attacksfangjiafu
 
Dns protocol design attacks and security
Dns protocol design attacks and securityDns protocol design attacks and security
Dns protocol design attacks and securityMichael Earls
 
NZNOG 2020 - The Trouble With NAT
NZNOG 2020 - The Trouble With NATNZNOG 2020 - The Trouble With NAT
NZNOG 2020 - The Trouble With NAT
Mark Smith
 
DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024
DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024
DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024
APNIC
 
DDoS Threat Landscape - Ron Winward CHINOG16
DDoS Threat Landscape - Ron Winward CHINOG16DDoS Threat Landscape - Ron Winward CHINOG16
DDoS Threat Landscape - Ron Winward CHINOG16
Radware
 

Similar to PLNOG 17 - Patryk Wojtachnio - DDoS mitygacja oraz ochrona sieci w środowisku szeroko uwielbianego WordPress'a :) (20)

Practical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacksPractical steps to mitigate DDoS attacks
Practical steps to mitigate DDoS attacks
 
AusNOG 2016 - The Trouble with NAT
AusNOG 2016 - The Trouble with NATAusNOG 2016 - The Trouble with NAT
AusNOG 2016 - The Trouble with NAT
 
Cloudflare lower network latency = faster website loads
Cloudflare lower network latency = faster website loadsCloudflare lower network latency = faster website loads
Cloudflare lower network latency = faster website loads
 
Testing High Performance Firewalls
Testing High Performance FirewallsTesting High Performance Firewalls
Testing High Performance Firewalls
 
Multi-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation StrategiesMulti-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation Strategies
 
Multi-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation StrategiesMulti-Layer DDoS Mitigation Strategies
Multi-Layer DDoS Mitigation Strategies
 
Helen Tabunshchyk "Handling large amounts of traffic on the Edge"
Helen Tabunshchyk "Handling large amounts of traffic on the Edge"Helen Tabunshchyk "Handling large amounts of traffic on the Edge"
Helen Tabunshchyk "Handling large amounts of traffic on the Edge"
 
Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...
Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...
Проксирование HTTP-запросов web-акселератором / Александр Крижановский (Tempe...
 
Network tunneling techniques
Network tunneling techniquesNetwork tunneling techniques
Network tunneling techniques
 
PLNOG16: Usługi w sieciach operatorskich, Marcin Aronowski
PLNOG16: Usługi w sieciach operatorskich, Marcin AronowskiPLNOG16: Usługi w sieciach operatorskich, Marcin Aronowski
PLNOG16: Usługi w sieciach operatorskich, Marcin Aronowski
 
Primer to Browser Netwroking
Primer to Browser NetwrokingPrimer to Browser Netwroking
Primer to Browser Netwroking
 
Realtime Detection of DDOS attacks using Apache Spark and MLLib
Realtime Detection of DDOS attacks using Apache Spark and MLLibRealtime Detection of DDOS attacks using Apache Spark and MLLib
Realtime Detection of DDOS attacks using Apache Spark and MLLib
 
Denial of services : limiting the threat
Denial of services : limiting the threatDenial of services : limiting the threat
Denial of services : limiting the threat
 
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi and Eri...
 
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...
How To Use Kafka and Druid to Tame Your Router Data (Rachel Pedreschi, Imply ...
 
Layer one 2011-gh0stwood-d-dos-attacks
Layer one 2011-gh0stwood-d-dos-attacksLayer one 2011-gh0stwood-d-dos-attacks
Layer one 2011-gh0stwood-d-dos-attacks
 
Dns protocol design attacks and security
Dns protocol design attacks and securityDns protocol design attacks and security
Dns protocol design attacks and security
 
NZNOG 2020 - The Trouble With NAT
NZNOG 2020 - The Trouble With NATNZNOG 2020 - The Trouble With NAT
NZNOG 2020 - The Trouble With NAT
 
DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024
DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024
DDoS In Oceania and the Pacific, presented by Dave Phelan at NZNOG 2024
 
DDoS Threat Landscape - Ron Winward CHINOG16
DDoS Threat Landscape - Ron Winward CHINOG16DDoS Threat Landscape - Ron Winward CHINOG16
DDoS Threat Landscape - Ron Winward CHINOG16
 

Recently uploaded

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
Frank van Harmelen
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
Generating a custom Ruby SDK for your web service or Rails API using Smithy
Generating a custom Ruby SDK for your web service or Rails API using SmithyGenerating a custom Ruby SDK for your web service or Rails API using Smithy
Generating a custom Ruby SDK for your web service or Rails API using Smithy
g2nightmarescribd
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 

Recently uploaded (20)

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
Generating a custom Ruby SDK for your web service or Rails API using Smithy
Generating a custom Ruby SDK for your web service or Rails API using SmithyGenerating a custom Ruby SDK for your web service or Rails API using Smithy
Generating a custom Ruby SDK for your web service or Rails API using Smithy
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 

PLNOG 17 - Patryk Wojtachnio - DDoS mitygacja oraz ochrona sieci w środowisku szeroko uwielbianego WordPress'a :)

  • 1. DDOS MITYGACJA ORAZ OCHRONA SIECI W ŚRODOWISKU SZEROKO UWIELBIANEGO WORDPRESS'A :) Patryk Wojtachnio
  • 2.
  • 3. ABOUT ME  Network Engineer at Fasthosts Internet Ltd (1&1 Group).  Previously Network & Security Engineer at PGE, MF, AtoS  IT Tech & Home Data Center blog owner (virtualolivia.com)  Bike Trial Rider & Car Movie Producer (rufzor.com)  Administrator of CCIE.PL board
  • 4. ABOUT CCIE.PL  The biggest Cisco community in Europe  Over 8300 users  Strong staff  3 general admins  1 board admin  3 servers admins  3 moderators  Over 60 polish CCIEs as members  over 20 of them actively posting!  About 100 new topics per month  About 800 posts per month  English section available
  • 5.
  • 6. AGENDA  General overview  DDoS categories  Mitigation  DDoS as a Service  Why WordPress ?  How to defend?  UK vs Polish law  Web hosting – case study   Network topology  UDP mitigation  TCP mitigation – Scrubbing Center
  • 7.
  • 8. DDOS CATEGORIES  Volumetric  Flood-based attacks that can be at layer 3, 4, or 7  Asymmetric  Attacks designed to invoke timeouts or session-state changes  Computational  Attacks designed to consume CPU and memory  Vulnerability-based  Attacks that exploit software vulnerabilities reference f5.com
  • 9. MITIGATION  Volumetric  Cloud-Based Scrubbing Service, Web Application Firewall  Asymmetric  Web Application Firewall  Computational  Application Delivery Controller Network Firewall  Vulnerability-based  IP Reputation Database Intrusion Prevention/Detection Systems (IDS/IPS), Application Delivery Controller reference f5.com
  • 10. MITIGATION  Layer 1/2  Cut cables, Jamming, EMP, MAC spoofing & flood  Layer 3  Floods (ICMP)  IP fragments (TCP fragmentation)  Layer 4  SYN, RST, FIN flood  Layer 5  Slowris  Layer 6  XML  Layer 7  SPAM, DNS queries reference f5.com
  • 11. DDOS AS A SERVICE (DDOS AAS)
  • 16. WHY WORDPRESS?  Most popular content management system  Require on-demand plugin update  Free  Vulnerability plugins
  • 18. THERE IS NO UNIVERSAL SOLUTIONS, THE DEFENCE OF OUR OWN INFRASTRUCTURE IS A WAY OF THINKING, BEING A GOOD STRATEGIST, AWARE OF THE WEAKNESSES AND STRENGTHS
  • 19. HOW WE WILL MEASURE THE IMPACT ON OUR INFRASTRUCTURE, AND HOW DOES THAT RELATIONSHIP WITH OUR CUSTOMERS?
  • 21. I DO NOT NEED PROTECTION? WHY?  Customer side  Impact ?  Am I ready to loose my customers ?  Data corruption ?  Reputation – Haters gona hate ?  $$$  Hosting provider  More wider look at the issue - think global  Business impact  SLA / ETR ?  Political - Hacktivism
  • 22. WHY NOC IS SO IMPORTANT ?  Incident management  Tools (Network Anomalies, Time changes)  24/7  Processes & Escalation  Standby Engineer always on call  First point of contact
  • 23. WHY NOC IS SO IMPORTANT ? - TOOLS  Focus on real data  Cacti  Netstat  Tcpdump  Wireshark  FlowViewer / Flow Grapher
  • 25. UK VS POLISH LAW reference http://www.legislation.gov.uk/ukpga/2006/48 http://www.legislation.gov.uk/ukpga/1990/18/section/3 http://isap.sejm.gov.pl/DetailsServlet?id=WDU19970880553
  • 26. CASE STUDY  Network topology  UDP mitigation  TCP mitigation  Blackholing
  • 27. R1 R2 DIST1 DIST2 SC2 SC1 SW1 SCRUBBING CENTER INTERFACE PORT-CHANNEL 4X40 GB VPC
  • 28. CASE STUDY – UDP MITIGATION – DNS  DNS Amplification  Small look-up query  Asymmetrical  Saturate network bandwidth capacity  DNS Flood  Saturate hardware side (Memory, RAM, CPU etc…  Symmetrical  Generated by script on compromised botnet machines
  • 29. CASE STUDY – UDP MITIGATION – DNS REFLECTION
  • 30. CASE STUDY – UDP MITIGATION – FRAGMENTS
  • 31. R1 R2 DIST1 DIST2 SW1 ip access-list extended OUTSIDE-ACL
  • 32. CASE STUDY – UDP MITIGATION – SAMPLE ACL IP ACCESS-LIST EXTENDED OUTSIDE-ACL 1 DENY UDP ANY HOST X.X.X.X 2 DENY UDP ANY HOST X.X.X.X FRAGMENTS 3 DENY UDP ANY EQ 53 HOST X.X.X.X 4 DENY UDP ANY EQ 4444 HOST X.X.X.X
  • 33. CASE STUDY – TCP MITIGATION
  • 34. CASE STUDY – TCP THREE WAY HANDSHAKE
  • 35. WWW.CCIE.PL BACKBONE DIST SW INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INNCOMMING TCP SYN FLOOD ON PORT 80 SIZE 100 GBPS
  • 36. WWW.CCIE.PL BACKBONE DIST SW INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INNCOMMING TCP SYN FLOOD ON PORT 80 SIZE 100 GBPS CUSTOMER IMPACT: 1000 CUSTOMER DOMAINS: 3000
  • 37. SYN FLOOD  How it works ?  Think3-way handshake  Host has a number of incoming free slots  When slots are full no more connections are accepted
  • 41. WWW.CCIE.PL BACKBONE DIST SW INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
  • 42. WWW.CCIE.PL BACKBONE DIST SC SW RFC1918 INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.1/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
  • 43. WWW.CCIE.PL BACKBONE DIST SC SW RFC1918 INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.1/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
  • 44. CASE STUDY – WORDPRESS VS HAPROXY  ACL  TCP SYN, Flood free  XMLRPC Brute Force Amplification  NGINX support  GREP & AWK knowledge required
  • 45. CASE STUDY – HAPROXY SAMPLE CONFIGURATION defaults log global timeout http-request 5s timeout queue 1m timeout connect 10s timeout client 30s timeout server 10s timeout check 10s option httplog timeout connect 5000 option httpchk maxconn 30000 timeout http-request 5s option httpclose retries 2 listen live_http_nginx_nodes bind 0.0.0.0:80 tcp-request inspect-delay 10s tcp-request content accept if HTTP
  • 46. CASE STUDY – HAPROXY SAMPLE CONFIGURATION - SLOWRIS /etc/haproxy/haproxy.cfg defaults option http-server-close mode http timeout http-request 5s timeout connect 5s timeout server 10s timeout client 30s  Will send slowly requests (header by header)  Will be waiting long time between each of them  It tells HAproxy to let five seconds to a clients to send its whole HTTP Request  Otherwise HAproxy will close connection
  • 47. CASE STUDY – HAPROXY CONFIGURATION - ACL # acl host_ccie(host) -i ccie.pl www.ccie.pl # acl allowed hdr(host) -i www.ccie.pl www.ccie.pl acl wplogin path_beg /wp-login.php acl xmlrpc_path path_end /xmlrpc.php # acl wplogin_rewrite path_beg /wp-log-me-in # http-request set-path /wp-login.php if wplogin_rewrite # http-request deny if host_singeply http-request deny if xmlrpc_path # http-request deny if !allowed
  • 48. CASE STUDY – HAPROXY
  • 49. WWW.CCIE.PL BACKBONE DIST SC SW RFC1918 INTERFACE GI0/0 DESCRIPTION WAN IP ADDRESS 1.1.1.1/24 INTERFACE ETH0 DESCRIPTION FRONTEND-INT IP ADDRESS 1.1.1.2/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.1/24 INTERFACE ETH1 DESCRIPTION BACKEND-INT IP ADDRESS 10.10.10.2/24
  • 50. THIS IS NOT ALL…  DNS Amplification  DNS Flood  HTTP Flood  IP Fragmentation Attack  NTP Amplification  Ping of Death  Ping Flood  R-U-Dead-Yet  Slowloris  Smurf Attack  SNMP Reflection  SYN Flood  UDP Flood https://pl.wikipedia.org/wiki/Nycticebus Nycticebus – rodzaj małpiatek z rodziny lorisowatych, obejmujący gatunki występujące w południowej Azji.
  • 51. CASE STUDY – BLACKHOLING IP ACCESS-LIST EXTENDED OUTSIDE-ACL 1 DENY TCP HOST X.X.X.X EQ 80 ANY