Re: pf to block against DDoS?

2008-09-22 Thread Lars Noodén
Redd Vinylene wrote: ... You can also use two tables so that the first overload gets shunted to a slow queue and given a second chance before ending up in the second table which gets blocked. ... Lars Noodin: Would you happen to have an example of that? Not really, here is an illustration

Re: pf to block against DDoS?

2008-09-22 Thread Redd Vinylene
On Mon, Sep 22, 2008 at 10:36 AM, Lars Noodin [EMAIL PROTECTED]wrote: Redd Vinylene wrote: ... You can also use two tables so that the first overload gets shunted to a slow queue and given a second chance before ending up in the second table which gets blocked. ... Lars Noodin: Would

Re: pf to block against DDoS?

2008-09-22 Thread Lars Noodén
Redd Vinylene wrote: ... a second chance? Well ssh on port 22 does occasionally have legitmate uses and even occasionally legitimate users. So some kind of indicator (such as a slowdown) could be useful for them. -Lars

Re: pf to block against DDoS?

2008-09-21 Thread Redd Vinylene
From: Redd Vinylene [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: pf to block against DDoS? Date: Thursday, September 4, 2008 - 3:23 pm Hello hello! I was quite shocked today when I heard I could use pf to block against DDoS attacks, using

Re: pf to block against DDoS?

2008-09-21 Thread Redd Vinylene
From: Redd Vinylene [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: pf to block against DDoS? Date: Thursday, September 4, 2008 - 3:23 pm Hello hello! I was quite shocked today when I heard I could use pf to block against DDoS attacks, using

Re: pf to block against DDoS?

2008-09-05 Thread Peter N. M. Hansteen
Oliver Peter [EMAIL PROTECTED] writes: I can recommend reading through this as well: http://www.bgnett.no/~peter/pf/en/bruteforce.html Thanks for recommending that! However I would generally recommend the maintained version which is up at http://home.nuug.no/~peter/pf/, with the direct link

pf to block against DDoS?

2008-09-04 Thread Redd Vinylene
Hello hello! I was quite shocked today when I heard I could use pf to block against DDoS attacks, using Stateful Tracking Options, http://www.openbsd.org/faq/pf/filter.html#stateopts. But does anybody have any nice setups of this they'd want to share? Much obliged, and thanks. -- http

Re: pf to block against DDoS?

2008-09-04 Thread Oliver Peter
On Thu, Sep 04, 2008 at 09:23:09PM +0200, Redd Vinylene wrote: Hello hello! I was quite shocked today when I heard I could use pf to block against DDoS attacks, using Stateful Tracking Options, http://www.openbsd.org/faq/pf/filter.html#stateopts. But does anybody have any nice setups

Re: pf to block against DDoS?

2008-09-04 Thread Subhro
What exactly are you looking for? Are you looking for example rulesets? Thanks Subhro On 9/5/08, Redd Vinylene [EMAIL PROTECTED] wrote: Hello hello! I was quite shocked today when I heard I could use pf to block against DDoS attacks, using Stateful Tracking Options, http://www.openbsd.org

Re: pf to block against DDoS?

2008-09-04 Thread Lars Noodén
Oliver Peter wrote: I can recommend reading through this as well: http://www.bgnett.no/~peter/pf/en/bruteforce.html You can also use two tables so that the first overload gets shunted to a slow queue and given a second chance before ending up in the second table which gets blocked. -Lars

Re: pf to block against DDoS?

2008-09-04 Thread johan beisser
On Sep 4, 2008, at 12:23 PM, Redd Vinylene wrote: I was quite shocked today when I heard I could use pf to block against DDoS attacks, using Stateful Tracking Options, http://www.openbsd.org/faq/pf/filter.html#stateopts. But does anybody have any nice setups of this they'd want to share