0

Past few days, we have been facing a possible syn flooding DOS attack. This attack happens twice a day (afternoon and at night), one random IP in our network gets active (even though the system on which the ip is assigned to is inactive/shutdown) and sends thousands of packets per second. Every time, its a new IP and on checking the systems, to which the IP's were assigned to, we find no traces of any activity, in some cases system logs showed the system was shutdown when this attack happened. Anti-Virus didn't detect much either on these systems. nmap and ping to these IP's doesnt work either, when the attack is actively happening. We found details of these attacks via web search report of our firewall, we saw IP's having sent Millions of hits within hours to some of the websites, consuming close to 100GB at a time (Note- only one IP does the attack at a particular time). Currently, we are blocking these IP's one by one after each attack, which is not feasible. which leads to the question. Answers to which, and suggestions would be greatly appreciated. How can we detect these attacks early on? How can we stop these attacks? What preventive measures can we take to make sure this doesnt occur in the future? reference image:- live dos attack packet flow

Akhil Abraham
  • 1
  • 1
  • Why did you block out the destination ip and url? That might give us some clue as to what is happening? – joeqwerty Dec 06 '20 at 16:20
  • destination IP's include our website's public IP and Public IP of few other legit websites. So, we had to block it – Akhil Abraham Dec 06 '20 at 17:05
  • A system which is shut down will not be generating hundreds of GB of traffic. Something is either picking a random IP on the subnet, getting one from DHCP (thus it is changing), or similar. Log MAC address - also easily spoofed but maybe gives a clue. – tater Dec 07 '20 at 09:05
  • We need more information in order to help you. Please provide a simple diagram of your network along with relevant device configurations. It's possible that the attacks are coming from the Internet, spoofing your internal IPs – Ron Trunk Dec 07 '20 at 15:40

0 Answers0