Denial of Service attack?

[mdrabble]

Currently our internet connection is experiencing some issues - smoothwall has have detected 83249 accesses to our external IP address in the last 15 minutes

 

The accesses are coming from random IP address.

 

Any suggestions on how I can try and combat this?

[bald_pig]

Contact your ISP, see what DDoS mitigations they have available

[Reverend_Dan]

If its virgin they quoted us 20k.

[mdrabble]

With M247 - just spoken to them and they are currently investigating for me

 

Dont really monitor the firewall and only noticed when the connection started dropping and logged on to the smoothie box to see what was going on.

[mdrabble]

Well as we dont pay for DDOS Mitigation there is very little they can do for us other than null all traffic and send it to a black hole - BUT we would experience a loss of connectivity.

 

Have asked for a quote.

 

In the mean time, looks like servers are from Azure, Tencent Cloud Computing (Beijing) Co. Ltd, Infolink LLC and a host of other places.

 

Looks like i'll have to weather the DDOS storm and hope it calms down soon!

[Wave9_Lee]

A quick/temp fix, might be to ask them to change your external IP address? Or if you have a backup link, switch traffic to that. You should check internally too, we've seen DDOS attacks originating from inside.

[mdrabble]

Already thought about switching to a different IP for traffic, problem is that all external IP address I have are in use - currently rejigging things so I can swap over to another IP and then remove the IP that is being targeted.

 

What I find very strange in that the website/moodle/RDP IP addresses are not being targeted.

[bald_pig]

probably a student searching "what is my ip" and plugging that into a DDoS service.

[mdrabble]

certainly a possibility.

 

I've changed IP address and disabled the original IP address on the interfaces but it is still being reported as having 80+ thousand access in the last 15 mins.

 

Have posted on the Smoothwall area asking what constitutes an "access" and I should be getting reports on the IP address even though it has been disabled.

[Opendium_Steve]

I've changed IP address and disabled the original IP address on the interfaces but it is still being reported as having 80+ thousand access in the last 15 mins.

 

This is unlikely to help you - traffic destined for that IP address will still be routed down your internet connection by the ISP (still using up your bandwidth) before being dropped on the floor by your router when it can't find anything to send it to. There's pretty much nothing you can do at your end - your ISP needs to block the traffic on their side of the connection. Some ISPs are more helpful than others - as someone else has already mentioned, in my experience Virgin will flatly refuse to help because they have an unaffordable "DDoS mitigation" package that they want you to buy. You're probably better off if you're with a smaller ISP who gives a damn rather than a big one who just wants to sell you more stuff.

[ibpalle]

What SteveHill said is indeed the main problem regarding DDOS - at the receiving end, very little can be done for mitigation locally due to the fact that it's the amount of traffic arriving that is the problem, not so much what it does.

[Opendium_Steve]

What SteveHill said is indeed the main problem regarding DDOS - at the receiving end, very little can be done for mitigation locally due to the fact that it's the amount of traffic arriving that is the problem, not so much what it does.

To add to this a little, I'm not sure what Smoothwall would consider an "access", or what protocol you're seeing the DDoS targetting, but 80k accesses over 15 minutes actually doesn't sound like a lot purely from a bandwidth perspective.

 

That equates to about 89 accesses per second - if we assume that each "access" is a single packet that the firewall is discarding, that only works out at about 1Mbps (89 accesses per second × 1500 byte maximum packet size × 8 bits per byte).

 

On the other hand, if we assume that each "access" is successfully establishing a connection with something (e.g. the smoothwall itself - which certainly shouldn't be happening if you've removed the affected IP) then it could well be overflowing the firewall's connection tracker and causing legitimate connections to drop/fail - that's definitely something to discuss with smoothwall's support folks since it is something you could potentially do something about on your end.

 

If there are any devices between the firewall and the internet which are doing any kind of connection tracking then they are potentially susceptible to similar problems, no matter what the Smoothwall itself is doing.

 

Note I don't have any knowledge about the internal workings of Smoothwall devices, I'm just making some educated suppositions from my knowledge of networking and Linux based firewalls.

Edited June 5, 2019 by Opendium_Steve

[SchoolsBroadband]

I'd recommend looking at your smoothwall logs to see if any user has tried to access any pages which can launch DDoS attacks for has put in a search term into Google of a similar effect. Changing your IP will fix it until the student again launches a new attack having figured out you've changed your IP's.

 

I'd be interested to know which suppliers on here have anti-DDoS mitigation. We've just invested £250k in a new anti-DDoS solution which has saved ours and our customers bacon on numerous occasions with some whoppers of DDoS attacks coming in over the past few weeks.....

 

Dave

[donsalvati]

What was the outcome of this? as we seem to be having similar issues. We have both BT and Virgin connections for failover and both our connections go down. BT and Virgin are both saying we are over utilising our connections. But don't know anything else than that. We have completely locked our Smoothwall down. Keep getting messages "Caution: have detected 36590 accesses to IP Address..." which is our external IP. When internet drops we receive a message on our Smoothwall saying, "fwloggerd - Buffer filled up - some packets have not been logged!", then "Failed to connect to Blockpage server". Smoothwall hasn't been able to identify any particular issue, but have said they are looking to increase this particular buffer size. We install Bandwidth module and set incoming and outgoing on the interfaces to cap at 900mb. But the internet still has gone down. AntiVirus not reporting anything unusual. Smoothwall Reports doesn't seem to pinpoint to anything either. BT and Virgin haven't been able to tell us if its any kind of attack/DDOS. Any ideas?

[Opendium_Steve]

What was the outcome of this? as we seem to be having similar issues. We have both BT and Virgin connections for failover and both our connections go down. BT and Virgin are both saying we are over utilising our connections. But don't know anything else than that. We have completely locked our Smoothwall down. Keep getting messages "Caution: have detected 36590 accesses to IP Address..." which is our external IP. When internet drops we receive a message on our Smoothwall saying, "fwloggerd - Buffer filled up - some packets have not been logged!", then "Failed to connect to Blockpage server". Smoothwall hasn't been able to identify any particular issue, but have said they are looking to increase this particular buffer size. We install Bandwidth module and set incoming and outgoing on the interfaces to cap at 900mb. But the internet still has gone down. AntiVirus not reporting anything unusual. Smoothwall Reports doesn't seem to pinpoint to anything either. BT and Virgin haven't been able to tell us if its any kind of attack/DDOS. Any ideas?

Not sure what kind of access you get to the Smoothwall box, but if possible try a tcpdump or wireshark of the internet connection and see what sort of traffic you're seeing. DDoS is frequently DNS traffic, so if you're seeing a gigabit of DNS traffic from all over the internet then you've got a DDoS going on. As discussed earlier in the thread, there's not a lot you can do on your end of the connection to mitigate a DDoS (in fact, capping your bandwidth is likely to make it worse if anything). You need the ISP's help to do some mitigation. Virgin were completely unhelpful the last time I dealt with a DoS on a virgin line, and I've never had to deal with it on a BT line so I can't comment. BT's techies are usually very good, but often their hands are tied by policy.

 

Both connections going down at the same time definitely sounds either intentional, but it might be that the smoothwall (which I presume is responsible for both connections) is getting overloaded and one of the connections is actually fine in itself. Can you monitor the bandwidth on the connections independently of each other?