what to do in a dos attack?

[yanksfan]

Hello,
In case it ever happens to me, I would just like to know what to do in a DOS attack? I mean, if the attackers are smart enough, they would be sending raw packets with false ip's, so there would be no way of tracking them. Also, it would be dumb to shutdown the network, because they would probably be waiting for it to come back online anyway. So, what would I do?

[draziw]

With a DoS attack? Well, there are lots of different scenarios, but if you can track the IP(s), you can often just blackhole the traffic on a router (hopefully) and go on about your business. Of course, tracing the traffic back to an ISP or their upstream and making a few calls is normally a good idea, too.

Sometimes it's also helpful to get your own upstream provider involved...

[yanksfan]

I'm kind of a newbie to networking and I don't know much yet, so can you explain these terms?

"Blackhole the traffic on a router"'?
"Get your own upstream provider"?

Thanks
-Mike

[ac1dsp3ctrum]

I'm kind of a newbie to networking and I don't know much yet, so can you explain these terms?

"Blackhole the traffic on a router"'?
"Get your own upstream provider"?

Thanks
-Mike

Im not sure about the second one but I think he means that you could just set your router to discard all taffic from that IP or IP's (depending on whether its a DoS or a DDoS)

[yanksfan]

does my router have to support that though, because I don't think it has that feature (I have a 3com home ethernet gateway).

-Mike

[ac1dsp3ctrum]

All routers are supposed to support it, if anything just set up a GOOD firewall to block all incoming traffic from the whole IP range (for example if I was being DoS'ed by 1.1.1.1 I would block 1.1.1.1-1.1.1.255 just to be safe)

[yanksfan]

but then, if the firewall you're talking about is a software firewall (since my router doesn't have a good firewall), then all those packets would still be getting to the server (even though they would be stopped by the firewall)? so then i think it would still be slowing down the server

[cwk9]

The best way to prevent a dos attack is to try and hide you ip address. A4proxy would be a good start. But if you do get a dos attack just turn off you computer and go for a walk. Most script kidz don't have an attention span long enough to dos you for hours on end.

[yanksfan]

ok, thanks all for the info