@MikeA said:
Did you have a problem with bullten? Or just too expensive? I've never even heard of them.
Edit - Not really worth to use VA still.. I just tested from TX (Spectrum) and the latency to BHS is literally only 1ms - 3ms worse.
I see you have extravm @ there good but they cant block tcp-ack i would buy it but...
I don't use OVH US. But if you tried my VPS and it can't block whatever you got hit with then OVH's Virginia servers won't either. The mitigation is all the same.
Edit - If you get these attacks that don't get blocked you should capture the traffic and give it to OVH or whatever company you use to get on their network, they actually do help if something is provided to prove an attack is bypassing the VAC.
@MikeA said:
Did you have a problem with bullten? Or just too expensive? I've never even heard of them.
Edit - Not really worth to use VA still.. I just tested from TX (Spectrum) and the latency to BHS is literally only 1ms - 3ms worse.
I see you have extravm @ there good but they cant block tcp-ack i would buy it but...
Does your service use TCP at all? If not just setup a VPN so you can still SSH into your box and ask them to block TCP completely. Otherwise setup a mirror/proxy/whatever on a high port so you can still get OS updates and ask them to block SYN-ACK packets with source ports <1024 as this is likely where to vast majority originates. Filtering by state would be the best but if they say they can't block them i guess it's not an option for them.
Huh? Well, basically that would be whatever port the garbage traffic uses (which is likely multiple). If you really want to filter (not sure if it's a good idea at all) you might try something like this:
Comments
What's Wrong With Your Keyboard?
Did you have a problem with bullten? Or just too expensive? I've never even heard of them.
Edit - Not really worth to use VA still.. I just tested from TX (Spectrum) and the latency to BHS is literally only 1ms - 3ms worse.
I see you have extravm @ there good but they cant block tcp-ack i would buy it but...
I don't use OVH US. But if you tried my VPS and it can't block whatever you got hit with then OVH's Virginia servers won't either. The mitigation is all the same.
Edit - If you get these attacks that don't get blocked you should capture the traffic and give it to OVH or whatever company you use to get on their network, they actually do help if something is provided to prove an attack is bypassing the VAC.
I smell shill...
Does your service use TCP at all? If not just setup a VPN so you can still SSH into your box and ask them to block TCP completely. Otherwise setup a mirror/proxy/whatever on a high port so you can still get OS updates and ask them to block SYN-ACK packets with source ports <1024 as this is likely where to vast majority originates. Filtering by state would be the best but if they say they can't block them i guess it's not an option for them.
@MikeA How Would I Capture The Traffic
tcpdump and please stop the the youtube headlines.
@MKSH And on what port?
Huh? Well, basically that would be whatever port the garbage traffic uses (which is likely multiple). If you really want to filter (not sure if it's a good idea at all) you might try something like this:
tcpdump -vni your-interface 'tcp[13] & 0x12 = 0x12'
@iBuyVPS This is useful - https://hackertarget.com/tcpdump-examples/
Yeah, that's a bit more educational than dumping a magic syn-ack filter on him.