遭到DDos攻击

1. 搜集证据  可以为路由器建立log server，建议使用SUN工作站或Linux等高速计算机捕获数据包。常用的数据包捕获工具包括TCPDump和snoop等。基本语法为： 
   
       tcpdump -i interface -s 1500 -w capture_file snoop -d interface -o capture_file -s 1500 
2. netstat -atun |grep SYN_RECV 可以找到SYN FLOOD攻击的来源。
3. tcpdump -r attack -n port 80 and net 100.0.0.0/8 |less  可以看到只有SYN没有ACK的连接

加上-vvv，可以看到 000000 IP (tos 0x0, ttl 244, id 256, offset 0, flags [none], proto TCP (6), length 380) 100.2.8.21.25435 > 219.232.22.21.1241: S, cksum 0x103f (incorrect (- > 0x0eeb), 1720276133:1720276473(340) win 16384 001250 IP (tos 0x0, ttl 244, id 256, offset 0, flags [none], proto TCP (6), length 949) 100.180.83.227.25613 > 219.232.22.21.1241: S, cksum 0xcbdf (incorrec t (-> 0x6a43), 1052079014:1052079923(909) win 16384  

   长度很大可是checksum是错误的。

---

1. 配备：比如思科，redbox,checkpoint的网络设备
2. 这些防火墙设备必须放置在机房接入主干网的路由下面才有效，因为托管服务器，多半是购买的带宽，而带宽多是百兆级别的，如果面对千兆级别的ddos，全部对外带宽会被占满。
3. 2010-03-25 13:15:29 HE-LF-KFQ-E-1.IDC %%01SEC/5/ATCKDF(l): Slot=1; AttackType:Syn flood attack; from 54.137.60.54 85.236.117.206 27.170.94.136 31.174.102.100 79.138.87.36 53.172.33.169 75.175.14.60 49.168.25.205 39.207.100.238 47.124.44.98 56.201.94.148 53.8.21.131 ; to 219.232.242.114 ; begin time :2009/07/19 23:33:34; end time: 2009/07/19 23:34:05; total packets: 842032; 2010-03-25 13:15:20 HE-LF-KFQ-E-1.IDC %%01SEC/5/ATCKDF(l): Slot=2; AttackType:Syn flood attack; from 111.101.109.88 109.118.122.105 34.242.104.11 24.103.120.101 35.206.114.206 65.199.80.123 28.120.46.226 7.28.94.243 70.72.5.10 97.92.18.217 62.146.98.52 79.27.0.93 ; to 219.232.242.114 ; begin time :2009/07/19 23:36:18; end time: 2009/07/19 23:36:49; total packets: 1695520; 2010-03-25 13:15:12 HE-LF-KFQ-E-1.IDC %%01SEC/5/ATCKDF(l): Slot=8; AttackType:Tracert attack; from 58.101.65.26 81.25.16.110 195.8.90.125 160.81.60.133 222.169.225.82 10.154.3.49 81.175.92.198 218.248.255.81 65.78.192.233 80.253.54.163 60.28.31.117 ; to 219.232.242.114 ; begin time :2010/03/25 12:47:48; end time: 2010/03/25 12:48:19; total packets: 60598; 2010-03-25 13:15:12 HE-LF-KFQ-E-1.IDC %%01SEC/5/ATCKDF(l): Slot=8; AttackType:ICMP redirect attack; from 88.42.65.217 93.179.233.79 ; to 219.232.242.114 ; begin time :2010/03/25 12:47:48; end time: 2010/03/25 12:48:19; total packets: 2243;  
4. 监控到的黑客的DDos流量有4G+

1.