Its an open ended general questions and i want to discuss before we start implementing anything.
As far as my knowledge goes by using firewalls we can only detect network level attacks such as TCP SYN attacks or malformed packet floods. I also know that there is no way that the hardware can analyze the packet and find out whether a particular IP is trying to load the site too many times. So should we provide some kind of application level hacks to stop DOS attacks? If yes how? During some googling I also found out that some firewalls such as Comodo Firewall Pro has a built-in Emergency Mode which is activated when the number of incoming packets per seconds exceed a set value for more than the specified time, for example, more than 20 packets/sec for more than 20 seconds. If this happens, the firewall classifies it as a DoS attack and switches to Emergency Mode and stops all inbound traffic from the IP. So the question is what is a prudent way of stopping DOS attacks 1) Leave it to the hardware firewalls/routers/switches/ 2) In addition to hardware build something in the application. If option 2 is needed does Restlet provide any kind of out of the box cache mechanism where IPs can be stored and looked at periodically? I know I can build one but just curious what everybody's thoughts are?
