Intrusion Detection for dropped packets

RE: Intrusion Detection for dropped packets

Kipland Iles — Thu, 02 Mar 2017 17:20:57 GMT

Thanks again, BAlfson. I bookmarked Rulz this time.

RE: Intrusion Detection for dropped packets

BAlfson — Thu, 02 Mar 2017 16:46:31 GMT

I think you want #2 In Rulz, Kipland. You will see from that that the way to drop the traffic before everything else is a blackhole DNAT.

Cheers - Bob

RE: Intrusion Detection for dropped packets

Kipland Iles — Wed, 01 Mar 2017 11:30:35 GMT

[quote user="dirkkotte"]the flood protection drop packets before these reach the packetfilter/statefull engine/NAT engine/... to protect the system[/quote]

Thanks dirkkotte. That explains the IPS logging. Will want to read BAlfson packet flow explanation.

Part of the reason for reaching out on this is that we incurred some additional bandwidth usage charges at the datacenter because of these DDOS attacks. I noticed that our WAN bandwidth usage dropped significantly after applying the new firewall rule but that does not stop the attackers from trying and being turned away. It apparently keeps IPS busy, as well. Perhaps some adjustment to IPS will help prevent them from coming back for more - similar to Fail2Ban that I use on my load balancers.

RE: Intrusion Detection for dropped packets

dirkkotte — Wed, 01 Mar 2017 01:07:24 GMT

the global policy settings are necessary for the snort engine.

IPS pattern use packet direction "out->in" "in->in" "in->out" to check the applicability of a rule.

the flood protection drop packets before these reach the packetfilter/statefull engine/NAT engine/... to protect the system.

Bob (BAlfson) has a great explanation of packet flow. But i have the link at the moment.