In recent years, with the Trojans, the increasing spread of the virus, the Internet denial of service attack frequency and attack traffic also will be a rapid increase in attack, attack and attack resources, technology continues to mature at the same time, anti-denial of service related to hardware and software products also received considerable development. Today’s IDC market has basically to the lack of effective means of defense of denial of service attacks will not be able to conduct a stable IDC operations position.
However, denial of service a wide range of defense products, the price difference is very large, from several hundred dollars installed on the target server on a single server to tens of thousands of software firewall protection, and even more than a dozen million Fast, Gigabit hardware firewall, including the provision of new and emerging hardware firewall programs and DIY hardware firewall to help customers cost-effective alternative to programs, customers are often at a loss, especially for the DIY hardware firewall used by the relevant technical, defensive ability did not understand that it often at a loss in the choice.
The use of various denial of service attack prevention products and solutions, this paper I will present the mainstream of denial of service attack, the corresponding means of defense and the corresponding analysis of the current defense strategy to attack a variety of means of defense of the merits of the mainstream because of denial of service attack , IDC industry, the invisible barriers to entry been raised a lot. Understanding of the IDC market, investors in making investment in IDC room from time to time have to consider the corresponding denial of service attack defense strategy. The current choice of denial of service attack (DDoS) solutions, roughly divided into:
1, the software firewall solution
2, the hardware firewall solution
3, DIY hardware firewall solution
Section Cost Comparison
For the IDC operations in terms of cost and defensive characteristics of the sub-line, its advantages and disadvantages are as follows:
1, the software firewall solution because it is installed on the server being protected, their defense capabilities and defense area is limited, larger flow in the attack case, on the target server hardware resources to take up serious, and if the number of servers more room, the overall the cost is also high. But the software firewall easy installation, without moving the hardware device, the deployment of very flexible.
2, the hardware firewall is the extensive use of IDC and can play the actual effect of the defense program, the drawback is the cost of investment is too high, small and medium IDC difficult to accept the purchase cost is usually in the Fast products in the 2-4 million, Gigabit in the 6-8 million. If you need high-bandwidth defense, the cluster cost.
3, the emerging DIY hardware firewall program. And a different software firewall, DIY hardware firewall program is installed on the client by preparing their own hardware platform kernel software and hardware firewall in general the same defense capabilities and defense capabilities. As the hardware platform has user-ready, so it can use existing equipment, the total cost of ownership to a minimum. In general, Fast defense costs will be about 1,000 yuan per room per month, Gigabit defense as 1,500 yuan a month.
For the defense capability, the software firewall because of its mode of defects can not be right to establish protection of the entire cabinet or the room, filtering attack packets will also affect the system resources consumed by the normal application of the target system, so no rating here.
Hardware firewalls are all X86 architecture, popular for the hardware firewall is a computer, not specifically dedicated for the network processing chip, and DIY hardware firewall defense the same pattern all along the entire cabinet and the room for protection, and be able to cluster high-volume attack on defense, so we will be focusing our attention on the hardware firewall and DIY hardware firewall.
Defense capability and overall cost of ownership compared:
Cost of Ownership Form from the right point of view, the hardware firewall as a mainstream means of defense, its total cost of ownership is also high, as a compromise of the DIY hardware firewall, which provides a monthly charge for his services a good way to solve the IDC Daoshi facing financial pressures and investment risks and other issues.
II defense function contrast (attack articles)
On defense function, we can not fail to analyze the major domestic Internet denial of service attack tool, today the main use of the Internet means of attack are: SYN-FLOOD: Veteran DDOS attack, using TCP protocol weaknesses initiated three-way handshake attack, is characterized by attacks on the source address is a false address, is not easy to trace the attack source. Attacker in the unit time constructed TCP-SYN packet number of the more effective their attacks on the more remarkable.
A single site SYN attack: the use of three-tier defense against the current cluster switching equipment (such as the Cisco three-layer switch) for port aggregation and load balancing algorithms, when balancing the loopholes in the use of real or virtual into a single source address and the same source port attack. Such attacks in the majority of three-way switching device will be exchanged through a single line, thus weakening the effect of the cluster defense.
Real-situ SYN attack: for some of the software firewall and hardware firewall’s defense theory, specifically addressing the reverse firewall defense style of the attack was launched. The network the last two years the establishment of a puppet machine value chain, enabling real-SYN attack site on the Internet is now becoming more of a attack, an attacker by controlling the puppet of the many machines to send attack packets.
SYN big pack attacks: SYN attacks and general different, SYN packet attack is large by constructing a very large TCP data packets, causing network congestion have been targeted attacks on the way to achieve results, and general SYN is different from attacks initiated by the same flow rate, sending large data packet sender occupy less system resources.
UDP big pack attack: relative to the TCP protocol data packets, the attacking side less system resources need only be able to build a UDP packet, which also vigorously for an attacker to send a UDP packet to provide the conditions for the attack, UDP attacks generally through Large data packets clogging network bandwidth to achieve.
Agent CC attacks: the initial attack by the Chinese to attack the software off the Internet triggered a large number of agents CC attack. Appeared on the Internet through the collection of a large number of free and open proxy server, through the submission of a large number of targeted attacks on these servers destination address of the access request by the proxy server transit attacks. CC to launch attacks on their client agent requires only a common broadband lines, its attack is the real address of address (the proxy server address), once led a number of network operators suffer.
SYN-ACK, PSH-ACK, etc.: for TCP connections initiated by a variety of weaknesses in attack.
Legend DB Attack: Legend of the database-specific attack, but also by the Chinese to attack the first customer to write exploits, the attack is to simulate the legendary customer segment Create account movements, making the legendary server to its knees.
Legends Brush villain attacks: the last off the assembly line through the non-stop and simulated landing, making the legendary server crashes