i am doing research on DOS attack and counter measure . Through LOIC tool i am generating Dos attack on server and through Snort tool the attack is detecting now my question is how to discard these DOS packets using snort? kindly help your prompt response will be appreciate
Snort is a "detection software". It can help you "detect" when a DDoS attack is underway on your server, but it cannot help you much with "protection".
What you can do is create a script that will be executed upon detection (via snort) which will blacklist addresses identified as sources of this DDoS attack. This can be a simple bash script (shell script) which will add the reported address (use command line parsers) to the blacklist of your server (iptables or similar).
This is the simplest way to do it on a single server configuration.
If you are using a more complex infrastructure, such as a few servers, load balancers, a firewall (or firewalls in case of multiple APs), you could install packages on your firewalls that support remote configuration changes (adding addresses to their blacklists) and have your script (invoked upon snort's detection) execute the remote call to these firewalls through your local network. This requires some setup, configuration, possibly even some own coding and scripting, but it is perfectly doable.
I am doing the same sort of research right now. I was under the impression that snort could detect dos/ddos and then you could create rule to drop the detected BAD packets immediatley as soon as detected ? Therefore not allowing DDOS to damage your network ? However I haven't worked out how yet. But when you create the rules ALERT there are other actions you can take too such as DROP.
- Badges
- Science topic
- Similar topics
- Geoscience
- Asia
- India