[w00t]

One thing you fail to recognize here is database queries to check if a specific IP is allowed are really slow. The check itself could be leveraged to DoS the SQL server.

[Ultimatum]

One thing you fail to recognize here is database queries to check if a specific IP is allowed are really slow. The check itself could be leveraged to DoS the SQL server.

Very true. Such as using Cain and Abel, and poisoning a network can also DoS the network, when attempting to turn your PC into a router.

[w00t]

What? I was simply saying that "SELECT x from y WHERE z LIKE a" is a really, really, slow search, and therefore uses lots of computation time. By sending enough requests that force you to do that with my IP, your SQL server wouldn't respond very fast, if at all.

[3SidedSquare]

Consider the following:

1) Connection from client to server is established (unavoidable)
2)The server checks to see if it is in a "high traffic" time
3) The connection origin is checked against "trusted" ip's (I know I said database, but hey, it was an idea in it's infancy. It seems like it could work much faster if if ip's were stored in a tree in memory, since it's a white list and not a blacklist, it should fit for a while)
4) a - the ip is not trusted, and is dropped
b - the ip is trusted, and the server can take more time and resources to serve the request.

The only reason I mention the tree is because a database is not really needed. The ip's don't even have to be stored, just the "trust" levels in the correct position in the tree. Give me a sec and I'll write some pseudo code.

threshold is the threshold trust level for high-traffic times
conn is the connection object
head is a tree of trust levels, according to the ip address, with 10 children for every parent. (0-9)
isHighTraffic is a method that determines if the server is in a high traffic time, returns boolean
serveRequest is a method that serves the request, given a connection object.

Code:

function connect (conn) { if(!isHighTraffic) { serveRequest() } else { if(trusted(conn.getIP(), head) { serveRequest() } } } function trusted(integer i, treeNode parent) //May need some formating, but expect the integer as a 12-digit integer, may need to be a long long int, depending on language { if(i%10 == i) //If the digit is the last one left { return parent.hasChild(i) && parent.get(i) > threshold //Find if the final digit of the ip is "trusted" } int leftDigit = i/(10^i.digits()) if(parent.hasChild(leftDigit) // Just keep going recursively though the tree { return trusted(i%10^i.digits()) } //If we haven't already gone back to recursion, accepted the ip, it means the ip is not even on the list of "trusted" ip's return false }

[w00t]

That is actually a worse approach.

For a full-length IP( 255.255.255.255, for example ) you would have an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array.

It's a lot of memory.


To be clear, I don't have a much better way to do it. Part of the problem is that this check will be ran for every attempted connection during an attack, generally in the thousands per second. A better use of this might be to prevent spam posting by a bot.

[ErroraBorealis]

This sounds to me like it would just slow your server down more. It takes power to check, while you're being flooded. This filter wouldn't stop the packets from coming in at all, just add to the stress.

[3SidedSquare]

That is actually a worse approach.

For a full-length IP( 255.255.255.255, for example ) you would have an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array of an array.

It's a lot of memory.

tree =/= array

nodes =/= tons of memory taken up.

looks like I can't put this to rest without actually doing it.

opening a small text file 100,000 times takes nearly 1 second

Spoiler:

writing script to test traversing a tree of ip's now.

[ErroraBorealis]

tree =/= array

nodes =/= tons of memory taken up.

looks like I can't put this to rest without actually doing it.

opening a small text file 100,000 times takes nearly 1 second

Spoiler:

writing script to test traversing a tree of ip's now.

How will the script stop packets from hitting your server?

[3SidedSquare]

How will the script stop packets from hitting your server?

I'm not sure there's a way to do that, all you can do is not waste any more resources on it if it's spam, the point is to determine what is and is not spam.

I actually looked on Wikipedia for this, and most of the methods for blocking ddos involve hardware, what I'm proposing is closest to what wiki calls "Rate-based Intrusion Prevention System"

A rate-based IPS (RBIPS) must analyze traffic granularly and continuously monitor the traffic pattern and determine if there is traffic anomaly. It must let the legitimate traffic flow while blocking the DoS attack traffic.

[ErroraBorealis]

I'm not sure there's a way to do that, all you can do is not waste any more resources on it if it's spam, the point is to determine what is and is not spam.

I actually looked on Wikipedia for this, and most of the methods for blocking ddos involve hardware, what I'm proposing is closest to what wiki calls "Rate-based Intrusion Prevention System"

I think it'd be a good idea to have a server to filter traffic on it's own to make this effective, that's pretty much what cloudflare does.