TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Warning: I work for a company which produces an attack-mitigation
tool...
You may want to consider a different solution. The rskills will
terminate the TCP-connection state on the attacked server, but if
the server is vulnerable to connection-table exhaustion, that may
be too late.
There are other SYN-Flood mitigation solutions out there, which
recognize the SYN-Flood early on, and block/proxy succeeding SYNs
at the (in-line) appliance, in front of the server. Of course,
your Internet uplink will continue to be filled with SYNs from
the (presumably spoofed and distributed) attack, but at least
your servers will stay up, and the threshold has been pushed
that much higher.
I regret to say that eliminating/blocking the attacks is not
entirely in your hands: at some point, a solution has to move
upstream to your ISP, the backbone, and the periphery ISP(s)
where the attacks initiated.
Charles
-----Original Message-----
From: Yong, David [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 23, 2001 5:55 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: RE: RealSecure 6.0 rskill question
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I don't think that rskill will help, because a Synflood can be successful
without a fully established connection. When a synflood comes, the rskill
sends rst's, but it's too late because the syns are already there. rskills
don't block the syns, they just fire back rst's. That doesn't help if the
attack doesn't intend on setting up a full connection.
-----Original Message-----
From: Verne Baxter [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 22, 2001 11:09 AM
To: '[EMAIL PROTECTED]'
Subject: RealSecure 6.0 rskill question
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I have RealSecure set to kill SYNFlood attacks via rskill (which are
tagged). At what phase of the connection attempt does this happen? The
reason I ask is that we recently had a SYNFlood attack on our mail server.
It was comprised of two attacks a minute apart from different IPs. One hit
port 25 while the other hit port 110. The server had to be rebooted prior
to SMTP functioning again. I am concerned that rskill may have been the
problem either directly or because it did not kill the attacks soon enough?
Verne Baxter
Sierra Tel Internet
[EMAIL PROTECTED]
