Need DDoS defense mechanism

[Efigenio]

Hi all,

I read the What is DDoS attack? DoS attack. There are many ways, the most basic DoS attacks is to use a reasonable service request to take up too much service resources so that legitimate users do not get response. DDoS attack methods is based on a traditional DoS attacks generated by a class of attack. I want to know about the DDoS defense mechanism. Can anybody have any idea. Please help. Thanks in advance.

[Snake08]

DDoS is not as invasive as simple as a host. In general, hackers carry out DDoS attacks go through these steps:
1. Collection to understand the goals of the
The following situation is very concerned about hackers information:
# The number of host targets, address the situation.
# Target host configuration, performance.
# Target bandwidth.
For DDoS attackers, attacking a site on the Internet, such as the mytarget website. One of the highlights is that in the end to determine the number of hosts in support of this site, a large Web site may have many hosts to use load-balancing Technology. To provide the same services to a Web site www. Therefore, intelligence gathering prior to the DDoS attacker is very important, it relates to the use of the number of units in order to achieve the desired effect a puppet machine problems. Briefly considered in the same conditions, the attack on the same site in two host machines require two sets, then a puppet to attack five hosts may need more than five units a puppet machine. Some people say that doing a puppet attack aircraft as possible, anyway, no matter how many host I have to use as many machines to attack it wants a puppet, a puppet machine over time better.

[Zachary]

The hacker is generally done scanning, random or targeted use of scanners to discover the Internet, those who are vulnerable machines, such as procedures for overflow, cgi, Unicode, ftp, database vulnerabilities. Also hackers would like to see the scan results. Then came the attempt to invade the specific means to not say much here, and interested. In short hackers are now occupied by a puppet machine has! Then he do? Apart from the above mentioned rubbing the back door to remain outside the footprints of these basic tasks, DDoS attacks, he will set out the procedures used in the past, the general is the use of ftp. In the attack aircraft, there will be a DDoS of the bidding process, a hacker is to use it to send to the victims of malicious attacks target packet. All the best.

[Big Fish]

You need to prevent your servers being used as tools to harm anyone Router.
With Cisco routers, for example:
# Cisco Express Forwarding (CEF)
# To use unicast reverse-path
# Access Control List (ACL) filtering
# Set flow rate of SYN packets
# Upgrade version of the ISO is too low
# Build log server for router.
All the best.

[Shen]

You can use CEF and the Unicast setting that should pay special attention to improper use can cause a serious decline in the efficiency of the router, upgrading IOS should also be cautious. Router is the core of the network devices to share with you when changes are a small set of experience, that is not saved first. Cisco routers have two configuration startup config and running config, modify the time change is the running config, you can make this configuration many period of time (35 days of the casual is), that a viable and then save the configuration to the startup config; while If you are not satisfied to restore the original configuration, with the copy start run on the list. Check and reply.

[Steve123]

You can use SP / ICP Manager. ISP / ICP for many small and medium scale enterprises to provide a variety of hosting services, so anti-DDoS, in addition to the enterprise as a means to network administrators, but also pay special attention to customers within the scope of their management managed host does not become a puppet machine. Objectively speaking, the safety of these managed hosts generally poor. All the best.