Messages in this thread | | | Date | Tue, 9 Mar 1999 16:42:38 +0800 (CST) | From | Yu Guanghui <> | Subject | Re: 2.0.36: ip_masqurade and stealth scan DoS |
| |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
hi
I have meet the seem problem.I wrote a little perl script to monit the TCP_CONNECT count.When I found sb. use the scan program, I disconnect he network connection about 10 mins.
I attech it to you.Hope this script can be useful to you.
BTW: I¡¡modified the include/net/ip_masq.h ---> the prots number that ip_msaq can use.(defalut is 4k): I have change it to: #define PORT_MASQ_BEGIN 41000 #define PORT_MASQ_END (PORT_MASQ_BEGIN+16384)
And I changed the net/ipv4/ip_masq.c too.There was a #define IP_MASQ_TAB_SIZE 8192 ( I change it to 8192).
yours saka
_ _ // Yu Guanghui /> Network Center \ // ygh@rose.dlut.edu.cn // Dalian Univ. of Tech. // \> http://banyan.dlut.edu.cn/~ygh </ China </
On Mon, 8 Mar 1999, Daniel Ryde wrote:
> Hi, > > We have a problem with ip_masqurading set up as a firewall. When someone > runs a stealth scan from the masquraded net to the outside net, it will > very fast consume all available masqurade ports. The result is a nasty > DoS for all adresses on the masquraded net. > > Is there any possibly limit on masqurade ports per source adress? > This would effectively stop the scan, and limit the DoS to the offender > only. > > I guess this problem also affects 2.2 kernels as well. > > Is there anyone else that has been hit by this problem? > > > Best Regards > > Daniel Ryde, System Administrator > __________________________________________________________________________ > Tripnet AB Visit Address: Telephone: +46 31 7252500 > Box 5071 Avagen 42 Facsimile: +46 31 7252501 > S-402 22 GOTEBORG GOTEBORG Email: ryde@tripnet.se > Sweden Sweden > > > - > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.rutgers.edu > Please read the FAQ at http://www.tux.org/lkml/ >
-----BEGIN PGP SIGNATURE----- Version: GnuPG v0.9.1 (GNU/Linux) Comment: Made with PGP4Pine
iD8DBQE25N8EfO4+kLYAZ4MRAny9AJ9wkDi0Wui/1m4JgCiqKjQokvzzrQCfeQX9 QLRsqhcNrlMB3I0u1GGJIMs= =nhC8 -----END PGP SIGNATURE----- #!/usr/bin/perl
open(LOG, ">/var/log/proxyht.log"); select(LOG); while(1){
@IpList=(); open(masq,"/proc/net/ip_masquerade")|| die "Cant open /proc/net/ip_masquerade:$!\n";
while(<masq>){ ($Prc,$From,$To,$Masq,$Initseq,$Delta,$PDelta,$Expires)=split(/ /); if( $Prc=~/TCP/){ ($FromIP,$FPrt)=split(/:/,$From); } if($IPtab{$FromIP} eq ""){ $IPtab{$FromIP}=1; }else{ $IPtab{$FromIP}++; } }
while (($IP, $count) = each(%IPtab)) { if($count >100 ){ $ascip=addr_inet(hex($IP)); $now_time=localtime; $IpListCnt{$ascip} = 0 unless defined ( $IpListCnt{$ascip}); } }
while (($IP,$count) = each (%IpListCnt)) { $IpListCnt{$IP}++; if ( $IpListCnt{$IP} == 1 ) { `/sbin/ipfwadm -I -i deny -S $IP/32 -D 0.0.0.0/0`; printf("$now_time $IP is using Proxy Hunter!!\n");; } else { if ( $IpListCnt{$IP} == 300) { `/sbin/ipfwadm -I -d deny -S $IP/32 -D 0.0.0.0/0`; $now_time=localtime; printf("$now_time Delete $IP \n"); delete ( $IpListCnt{$IP}); } } }
%IPtab={}; close(masq); sleep 2;
} #while
close(LOG); exit(0);
sub addr_inet() { my($digip) = @_; my($h1) = $digip/(2 ** 24); my($h2) = ($digip % 2 ** 24)/(2 ** 16); my($h3) = ($digip % 2 ** 16) /(2 ** 8); my($h4) = $digip % 256;
sprintf("%d.%d.%d.%d", $h1, $h2, $h3, $h4);
}
| |