A DDoS attack is when a network or online resource is denied to the intended user, and usually via a malicious means. DDoS means distributed denial-of-service. Protecting against denial of service is done in a number of ways.
Attack detection
Doing all you can to prevent an attack is key, and part of that is knowing when and how an attack is taking place.
Traffic classification
If you are able to tell which is genuine traffic and which is part of an attack then you may classify your traffic so that you can block any potentially malicious traffic.
Response
This is where you act in order to defend yourself, be it detecting, classifying or responding after an attack begins. Your response should feature all three.
Routers
Use them for their ACL ability and their rate-limiting abilities. You set them manually and you can help to stop router flooding. Routers are a lot like switches mentioned below.
Switches
These offer TCP splicing, traffic shaping, system-wide rate limiting, bogus IP filtering, and deep packet inspection. There are numerous ways of attacking, and switches help to prevent many of them.
Firewalls
Possibly the most popular defense and most people’s first defense. It simply allows and denies protocols, which protects you against many simple threats. It can ally or deny IP addresses and ports, and it can set up rules to block or drop traffic from suspicious sources.
Application front end hardware
This is a hardware solution that you play on the network that intercepts the traffic before it gets to the server. It figures out what the traffic is like if it regular or a potential threat and then deals with it accordingly. It is a filter that helps to stop some threats before they even get the chance to harm or slow down the server.
Cleaning centers
Using proxies, direct circuits and/or tunnels you may send your traffic to a scrubbing center or cleaning center. It works a little like the Application front end hardware mentioned above except that it is a little more advanced. Clean traffic is sent to the server whilst potential threats are withheld.
IPS based prevention
Intrusion-prevention systems may be handy if the attacks you get have signatures associated with them. They can also monitor traffic for anomalies that may affect the server/systems.
Sinkholing and Blackholing
This is where an attacked IP address or DNS is sent to the black hole. Sinkholing sends traffic to a valid IP address and rejects bad packets.
DDS based defense
This sort of defense will block connection-based DoS attacks. This includes the attacks that have bad intent but legitimate content.
ServerPronto offers the best affordable and secure hosting service in all dedicated server packages.
Photo cred: Flickr / Kreg Steppe
Comments are closed.