对付DDoS是一个系统工程,想仅仅依靠某种系统或产品防住DDoS是不现实的,可以肯定的是,完全杜绝DDoS目前是不可能的,但通过适当的措施抵御90%的DDoS攻击是可以做到的,基于攻击和防御都有成本开销的缘故,若通过适当的办法增强了抵御DDoS的能力,也就意味着加大了攻击者的攻击成本,那么绝大多数攻击者将无法继续下去而放弃,也就相当于成功的抵御了DDoS攻击。以下为笔者多年以来抵御DDoS的经验和建议,和大家分享!
1、采用高性能的网络设备****
首先要保证网络设备不能成为瓶颈,因此选择路由器、交换机、硬件防火墙等设备的时候要尽量选用知名度高、口碑好的产品。再就是假如和网络提供商有特殊关系或协议的话就更好了,当大量攻击发生的时候请他们在网络接点处做一下流量限制来对抗某些种类的DDoS攻击是非常有效的。
2、尽量避免NAT的使用****
无论是路由器还是硬件防护墙设备要尽量避免采用网络地址转换NAT的使用,因为采用此技术会较大降低网络通信能力,其实原因很简单,因为NAT需要对地址来回转换,转换过程中需要对网络包的校验和进行计算,因此浪费了很多CPU的时间,但有些时候必须使用NAT,那就没有好办法了。
3、充足的网络带宽保证****
网络带宽直接决定了能抗受攻击的能力,假若仅仅有10M带宽的话,无论采取什么措施都很难对抗现在的SYNFlood攻击,当前至少要选择100M的共享带宽,最好的当然是挂在1000M的主干上了。但需要注意的是,主机上的网卡是1000M的并不意味着它的网络带宽就是千兆的,若把它接在100M的交换机上,它的实际带宽不会超过100M,再就是接在100M的带宽上也不等于就有了百兆的带宽,因为网络服务商很可能会在交换机上限制实际带宽为10M,这点一定要搞清楚。
4、升级主机服务器硬件****
在有网络带宽保证的前提下,请尽量提升硬件配置,要有效对抗每秒10万个SYN攻击包,服务器的配置至少应该为:P4 2.4G/DDR512M/SCSI-HD,起关键作用的主要是CPU和内存,若有志强双CPU的话就用它吧,内存一定要选择DDR的高速内存,硬盘要尽量选择SCSI的,别只贪IDE价格不贵量还足的便宜,否则会付出高昂的性能代价,再就是网卡一定要选用3COM或Intel等名牌的,若是Realtek的还是用在自己的PC上吧。
5、把网站做成静态页面****
大量事实证明,把网站尽可能做成静态页面,不仅能大大提高抗攻击能力,而且还给黑客入侵带来不少麻烦,至少到现在为止关于HTML的溢出还没出现,看看吧!新浪、搜狐、网易等门户网站主要都是静态页面,若你非需要动态脚本调用,那就把它弄到另外一台单独主机去,免的遭受攻击时连累主服务器,当然,适当放一些不做数据库调用脚本还是可以的,此外,最好在需要调用数据库的脚本中拒绝使用代理的访问,因为经验表明使用代理访问你网站的80%属于恶意行为。
6、增强操作系统的TCP/IP栈****
Win2000和Win2003作为服务器操作系统,本身就具备一定的抵抗DDoS攻击的能力,只是默认状态下没有开启而已,若开启的话可抵挡约10000个SYN攻击包,若没有开启则仅能抵御数百个,具体怎么开启,可以参考一下微软的发文。
7、安装专业抗DDOS防火墙****
比如金盾防火墙就是使用率最高,最专业的抗DDOS防火墙。
8、其他防御措施****
以上的七条对抗DDoS建议,适合绝大多数拥有自己主机的用户,但假如采取以上措施后仍然不能解决DDoS问题,就有些麻烦了,可能需要更多投资,增加服务器数量并采用DNS轮巡或负载均衡技术,甚至需要购买七层交换机设备,从而使得抗DDoS攻击能力成倍提高,只要投资足够深入,总有攻击者会放弃的时候,那时候你就成功了!
现在你知道服务器如何防御DDOS攻击了吗?有效防御DDOS攻击可以选择驰网的DDOS高防服务,500G+的DDOS清洗能力,在用户遇到攻击时,通过DDOS高防体系抵御攻击流量,保证业务的正常运行。
扬州高防护段展示:
103.60.166.1
103.60.166.2
103.60.166.3
103.60.166.4
103.60.166.5
103.60.166.6
103.60.166.7
103.60.166.8
103.60.166.9
103.60.166.10
103.60.166.11
103.60.166.12
103.60.166.13
103.60.166.14
103.60.166.15
103.60.166.16
103.60.166.17
103.60.166.18
103.60.166.19
103.60.166.20
103.60.166.21
103.60.166.22
103.60.166.23
103.60.166.24
103.60.166.25
103.60.166.26
103.60.166.27
103.60.166.28
103.60.166.29
103.60.166.30
103.60.166.31
103.60.166.32
103.60.166.33
103.60.166.34
103.60.166.35
103.60.166.36
103.60.166.37
103.60.166.38
103.60.166.39
103.60.166.40
103.60.166.41
103.60.166.42
103.60.166.43
103.60.166.44
103.60.166.45
103.60.166.46
103.60.166.47
103.60.166.48
103.60.166.49
103.60.166.50
103.60.166.51
103.60.166.52
103.60.166.53
103.60.166.54
103.60.166.55
103.60.166.56
103.60.166.57
103.60.166.58
103.60.166.59
103.60.166.60
103.60.166.61
103.60.166.62
103.60.166.63
103.60.166.64
103.60.166.65
103.60.166.66
103.60.166.67
103.60.166.68
103.60.166.69
103.60.166.70
103.60.166.71
103.60.166.72
103.60.166.73
103.60.166.74
103.60.166.75
103.60.166.76
103.60.166.77
103.60.166.78
103.60.166.79
103.60.166.80
103.60.166.81
103.60.166.82
103.60.166.83
103.60.166.84
103.60.166.85
103.60.166.86
103.60.166.87
103.60.166.88
103.60.166.89
103.60.166.90
103.60.166.91
103.60.166.92
103.60.166.93
103.60.166.94
103.60.166.95
103.60.166.96
103.60.166.97
103.60.166.98
103.60.166.99
103.60.166.100
103.60.166.101
103.60.166.102
103.60.166.103
103.60.166.104
103.60.166.105
103.60.166.106
103.60.166.107
103.60.166.108
103.60.166.109
103.60.166.110
103.60.166.111
103.60.166.112
103.60.166.113
103.60.166.114
103.60.166.115
103.60.166.116
103.60.166.117
103.60.166.118
103.60.166.119
103.60.166.120
103.60.166.121
103.60.166.122
103.60.166.123
103.60.166.124
103.60.166.125
103.60.166.126
103.60.166.127
103.60.166.128
103.60.166.129
103.60.166.130
103.60.166.131
103.60.166.132
103.60.166.133
103.60.166.134
103.60.166.135
103.60.166.136
103.60.166.137
103.60.166.138
103.60.166.139
103.60.166.140
103.60.166.141
103.60.166.142
103.60.166.143
103.60.166.144
103.60.166.145
103.60.166.146
103.60.166.147
103.60.166.148
103.60.166.149
103.60.166.150
103.60.166.151
103.60.166.152
103.60.166.153
103.60.166.154
103.60.166.155
103.60.166.156
103.60.166.157
103.60.166.158
103.60.166.159
103.60.166.160
103.60.166.161
103.60.166.162
103.60.166.163
103.60.166.164
103.60.166.165
103.60.166.166
103.60.166.167
103.60.166.168
103.60.166.169
103.60.166.170
103.60.166.171
103.60.166.172
103.60.166.173
103.60.166.174
103.60.166.175
103.60.166.176
103.60.166.177
103.60.166.178
103.60.166.179
103.60.166.180
103.60.166.181
103.60.166.182
103.60.166.183
103.60.166.184
103.60.166.185
103.60.166.186
103.60.166.187
103.60.166.188
103.60.166.189
103.60.166.190
103.60.166.191
103.60.166.192
103.60.166.193
103.60.166.194
103.60.166.195
103.60.166.196
103.60.166.197
103.60.166.198
103.60.166.199
103.60.166.200
103.60.166.201
103.60.166.202
103.60.166.203
103.60.166.204
103.60.166.205
103.60.166.206
103.60.166.207
103.60.166.208
103.60.166.209
103.60.166.210
103.60.166.211
103.60.166.212
103.60.166.213
103.60.166.214
103.60.166.215
103.60.166.216
103.60.166.217
103.60.166.218
103.60.166.219
103.60.166.220
103.60.166.221
103.60.166.222
103.60.166.223
103.60.166.224
103.60.166.225
103.60.166.226
103.60.166.227
103.60.166.228
103.60.166.229
103.60.166.230
103.60.166.231
103.60.166.232
103.60.166.233
103.60.166.234
103.60.166.235
103.60.166.236
103.60.166.237
103.60.166.238
103.60.166.239
103.60.166.240
103.60.166.241
103.60.166.242
103.60.166.243
103.60.166.244
103.60.166.245
103.60.166.246
103.60.166.247
103.60.166.248
103.60.166.249
103.60.166.250
103.60.166.251
103.60.166.252
103.60.166.253
103.60.166.254
103.60.166.255