Mensajes

pocas tiendas vas a encontrar que vendan una grabadora para el portátil, ya que tienen un tamaño especial (más pequeñas).

Existir, existen, pero en pocas tiendas las tienen. En Barcelona sólo conozco una.

Hola Joesmi,

Dudo que existe alguna traducción de esta estupenda recopilación de programas que trae el Hiren's BootCD

La mayoría de aplicaciones son en inglés, y buscar su versión en español sería un rollazo.

El Hiren's BootCD se puede parchear para que reconozca el teclado en Español.

[Contenidos:]

Descarga:

http://www.hirensbootcd.org/files/Hirens.BootCD.15.1.zip

HBCD

CD con autoarranque para DOS con una sensacional recopilación de utilidades.

¿Te aparecen pantallas azules en Windows?  Puedes comprobar que no sea la memoria RAM.

¿Tu disco duro te da errores? Puedes escanear el disco duro en busca de errores y recuperar sectores defectuosos.

¿Has eliminado un archivo importante de la papelera? Recupéralo sencillamente con las utilidades que trae el Hiren's BootCD.

Hirens Boot CD es un CD autoarrancable que contiene todas las utilidades necesarias para el arranque del sistema después de un fallo grave. Contiene la mayoría de las aplicaciones de mantenimiento de sistemas: diagnóstico y análisis del sistema, antivirus, gestión de particiones, herramientas de recuperación de datos,...
Cuando arrancas el ordenador con el CD te aparece un menú con el que podrás ejecutar cualquiera de las siguientes aplicaciones:

  1. Particionamiento de Unidades de Almacenamiento
         * Partition Magic 8.2
         * Paragon Partition Manager 5.5
         * Partition Commander 8.01
         * Ranish Partition Manager 2.44
         * The Partition Resizer v1.3.4
         * Smart Fdisk 2.05
         * SPecial Fdisk
         * eXtended Fdisk
  2. Clonación de Discos
         * Drive Image 2002
         * Norton Ghost 8.0
         * Partition saber 2.80
  3. Antivirus
         * F-Prot Antivirus 3.14e
         * McAfee Antivirus 4.32
  4. Herramientas de Recuperación de Información
         * Offline NT/2K/XP Password Changer
         * Active Partition Recovery 2.1
         * Active Uneraser 2.1.1
         * Ontrack Easy Recovery Pro 6.3
         * Winternals Disk Commander 1.1
         * TestDisk 4.5.
         * Lost & Found 1.06
  5. Herramientas de Análisis y Diagnóstico
         * DocMemory 2.0
         * GoldMemory 5.07
         * Memtest 2.00
         * System Speed Test 4.78
         * PC-Check 5.50
         * The Troubleshooter 5.02
         * PC Doctor 3.0
         * Test Cpu/Video/Disk 5.6
  6. Herramientas para Discos Duros
         * Seagate Seatools Desktop Edition 2.10
         * Western Digital Data Lifeguard Tools
         * Maxtor PowerMax 4.6
         * Fujitsu HDD Diagnostic Tool 6.10
         * Samsung HDD Utility 1.11
         * IBM/Hitachi Drive Fitness Test
         * MHDD 2.9
         * HDD Regenerator 1.41
         * Ontrack Disk Manager 9.57
         * Norton Disk Doctor 2002
         * Norton Disk Editor 2002
         * Active Kill Disk 1.1
         * SmartUDM 2.00
  7. Herramientas de Análisis de Sistemas
         * Aida16 2.12
         * PCI and AGP info Tool
         * System Analyser version 5.3b
         * Navrátil Software System Information 0.58
         * Astra 4.20
         * HwInfo 4.93
         * PC-Config 9.33
         * SysChk 2.46
  8. Gestores de Ficheros DOS
         * Volkov Commander 4.99
         * Dos Command Center 5.1
         * File Wizard 1.35
         * File Maven 3.5
         * FastLynx 2.0
         * LapLink 5.0
         * Mini Windows 3.11
  9. Otras Herramientas
         * DosCDroast beta 2
         * Ontrack Data Advisor 5.0
         * Bootmagic 8.0
         * Picture Viewer 1.94
         * QuickView Pro 2.51
         * Universal TCP/IP Network 4.80
         * NTFS Dos Pro 5.0
 10. Herramientas DOS
         * NTFS Dos Pro 5.0
         * USB CD-Rom Driver 1
         * Universal USB Driver 2
         * Interlnk support at COM1
         * Interlnk support at LPT1
         * Otras herramientas del DOS
 11. Herramientas Windows
         * SpaceMonger 1.4
         * Drive Temperature 1.0
         * Disk Speed1.0
         * MemTest 1.0
         * PageDfrg 2.21
         * Split Join 1.3.3
         * Ghost Image Explorer 7.0
         * DriveImage Explorer 5.0
         * Active File Recovery 2.0
         * Restoration 2.5.14
         * Startup Control Panel 2.8
         * TCPView 2.34
         * Unknown Devices 1.2
         * Ad-Aware 6.181

Muy recomendado.

Código [Seleccionar] Expandir

Partition Tools
Partition Magic Pro 8.05
Best software to partition hard drive

Acronis Disk Director 10.0.2160
Popular disk management functions in a single suite

Paragon Partition Manager 7.0.1274
Universal tool for partitions

Partition Commander 9.01
The safe way to partition your hard drive,with undo feature

Ranish Partition Manager 2.44
a boot manager and hard disk partitioner.

The Partition Resizer 1.3.4
move and resize your partitions in one step and more.

Smart Fdisk 2.05
a simple harddisk partition manager

SPecial Fdisk 2000.03v
SPFDISK a partition tool.

eXtended Fdisk 0.9.3
XFDISK allows easy partition creation and edition

GDisk 1.1.1
Complete replacement for the DOS FDISK utility and more.

Super Fdisk 1.0
Create, delete, format partitions drives without destroying data.

Partition Table Editor 8.0
Partition Table and Boot Record Editor

EASEUS Partition Master 4.0.1
Partition Resize/Move/Copy/Create/Delete/Format/Convert, Explore, etc.

Backup Tools
ImageCenter 5.6 (Drive Image 2002)
Best software to clone hard drive

Norton Ghost 11.5
Similar to Drive Image (with usb/scsi support)

Acronis True Image 8.1.945
Create an exact disk image for complete system backup and disk cloning.

Partition Saving 3.71
A tool to backup/restore partitions. (SavePart.exe)

COPYR.DMA Build013
A Tool for making copies of hard disks with bad sectors

DriveImageXML 2.02
backup any drive/partition to an image file, even if the drive is currently in use

Drive SnapShot 1.39
creates an exact Disk Image of your system into a file while windows is running.

Ghost Image Explorer 11.5
to add/remove/extract files from Ghost image file

DriveImage Explorer 5.0
to add/remove/extract files from Drive image file

WhitSoft File Splitter 4.5a
a Small File Split-Join Tool

InfraRecorder 0.50
An Open source CD/DVD burning software, also create/burn .iso images

FastCopy 1.99r4
The Fastest Copy/Delete Software on Windows

Smart Driver Backup 2.12
Easy backup of your Windows device drivers (also works from PE)

Double Driver 2.1
Driver Backup and Restore tool

DriverBackup! 1.0.3
Another handy tool to backup drivers

Recovery Tools
Active Partition Recovery 3.0
To Recover a Deleted partition.

Active Uneraser 3.0
To recover deleted files and folders on FAT and NTFS systems.

Ontrack Easy Recovery Pro 6.10
To Recover data that has been deleted/virus attack

Winternals Disk Commander 1.1
more than just a standard deleted-file recovery utility

TestDisk 6.11.3
Tool to check and undelete partition from Dos/Windows

Lost & Found 1.06
a good old data recovery software.

DiyDataRecovery Diskpatch 2.1.100
An excellent data recovery software.

Prosoft Media Tools 5.0 v1.1.2.64
Another excellent data recovery software with many other options.

PhotoRec 6.11.3
Tool to Recover File and pictures from Dos/Windows

Active Undelete 5.5
a tool to recover deleted files

Restoration 3.2.13
a tool to recover deleted files

GetDataBack for FAT 4.0
Data recovery software for FAT file systems

GetDataBack for NTFS 4.0
Data recovery software for NTFS file systems

Recuva 1.29.429
Restore deleted files from Hard Drive, Digital Camera Memory Card, usb mp3 player...

Partition Find and Mount 2.3.1
Partition Find and Mount software is designed to find lost or deleted partitions

Unstoppable Copier 4.2
Allows you to copy files from disks with problems such as bad sectors,
scratches or that just give errors when reading data.

Testing Tools
System Speed Test 4.78
it tests CPU, harddrive, ect.

PC-Check 6.05
Easy to use hardware tests

Ontrack Data Advisor 5.0
Powerful diagnostic tool for assessing the condition of your computer

The Troubleshooter 7.02
all kind of hardware testing tool

PC Doctor 2004
a benchmarking and information tool

CPU/Video/Disk Performance Test 5.7
a tool to test cpu, video, and disk

Test Hard Disk Drive 1.0
a tool to test Hard Disk Drive

Disk Speed1.0
Hard Disk Drive Speed Testing Tool

S&M Stress Test 1.9.1
cpu/hdd/memory benchmarking and information tool, including temperatures/fan speeds/voltages

IsMyLcdOK (Monitor Test) 1.02
Allows you to test CRT/LCD/TFT screens for dead pixels and diffective screens

RAM (Memory) Testing Tools
GoldMemory 5.07
RAM Test utility

Memtest86+ 2.11
PC Memory Test

MemTest 1.0
a Memory Testing Tool

Video Memory Stress Test 1.7.116
a tool to thoroughly test your video RAM for errors and faults

Hard Disk Tools
Hard Disk Diagnostic Utilities
Seagate Seatools Graphical v2.13b
SeaTools for Dos 1.10
Western Digital Data Lifeguard Tools 11.2
Western Digital Diagnostics (DLGDIAG) 5.04f
Maxtor PowerMax 4.23
Maxtor amset utility 4.0
Maxtor(or any Hdd) Low Level Formatter 1.1
Fujitsu HDD Diagnostic Tool 7.00
Fujitsu IDE Low Level Format 1.0
Samsung HDD Utility(HUTIL) 2.10
Samsung Disk Diagnose (SHDIAG) 1.28
Samsung The Drive Diagnostic Utility (ESTOOL) 3.00g
IBM/Hitachi Drive Fitness Test 4.15
IBM/Hitachi Feature Tool 2.13
Gateway GwScan 5.12
ExcelStor's ESTest 4.50
MHDD 4.6
WDClear 1.30
Toshiba Hard Disk Diagnostic 2.00b

HDD Regenerator 1.71
to recover a bad hard drive

HDAT2 4.53
main function is testing and repair (regenerates) bad sectors for detected devices

Ontrack Disk Manager 9.57
Disk Test/Format/Maintenance tool.

Norton Disk Doctor 2002
a tool to repair a damaged disk, or to diagnose your hard drive.

Norton Disk Editor 2002
a powerful disk editing, manual data recovery tool.

Hard Disk Sentinel 0.04
Hard Disk health, performance and temperature monitoring tool.

Active Kill Disk 4.1
Securely overwrites and destroys all data on physical drive.

SmartUDM 2.00
Hard Disk Drive S.M.A.R.T. Viewer.

Victoria 3.33e and 3.52rus
a freeware program for low-level HDD diagnostics

HDD Erase 4.0
Secure erase using a special feature built into most newer hard drives

HDD Scan 3.2
HDDScan is a Low-level HDD diagnostic tool, it scans surface find bad sectors etc.

HDTune 2.55
Hard disk benchmarking and information tool.

Data Shredder 1.0
A tool to Erase disk and files (also wipe free space) securely

System Information Tools
PCI and AGP info Tool (2908)
The PCI System information & Exploration tool.

System Analyser 5.3w
View extensive information about your hardware

Navratil Software System Information 0.60.32
High-end professional system information tool

Astra 5.43
Advanced System info Tool and Reporting Assistant

HWiNFO 5.3.0
a powerful system information utility

PC-Config 9.33
Complete hardware detection of your computer

SysChk 2.46
Find out exactly what is under the hood of your PC

CPU Identification utility 1.17
Detailed information on CPU (CHKCPU.EXE)

CTIA CPU Information 2.7
another CPU information tool

Drive Temperature 1.0
Hard Disk Drive temperature meter

PC Wizard 2009.1.90
Powerful system information/benchmark utility designed especially for detection of hardware.

SIW 2009-07-28
Gathers detailed information about your system properties and settings.

CPU-Z 1.52
It gathers information on some of the main devices of your system

PCI 32 Sniffer 1.4 (2908)
device information tool (similar to unknown devices)

Unknown Devices 1.2 (2908)
helps you find what those unknown devices in Device Manager really are

USBDeview 1.42
View/Uninstall all installed/connected USB devices on your system

MBR (Master Boot Record) Tools
MBRWork 1.07b
a utility to perform some common and uncommon MBR functions

MBR Tool 2.2.100
backup, verify, restore, edit, refresh, remove, display, re-write...

DiskMan4
all in one tool for cmos, bios, bootrecord and more

BootFix Utility
Run this utility if you get 'Invalid system disk'

MBR SAVE / RESTORE 2.1
BootSave and BootRest tools to save / restore MBR

Boot Partition 2.60
add Partition in the Windows NT/2000/XP Multi-boot loader

Partition Table Doctor 3.5
a tool to repair/modify mbr, bootsector, partition table

Smart Boot Manager 3.7.1
a multi boot manager

Bootmagic 8.0
This tool is for multi boot operating systems

MBRWizard 2.0b
Directly update and modify the MBR (Master Boot Record)

BIOS / CMOS Tools
CMOS 0.93
CMOS Save / Restore Tool

BIOS Cracker 4.8
BIOS password remover (cmospwd)

BIOS Cracker 1.4
BIOS password remover (cmospwc)

BIOS Utility 1.35.0
BIOS Informations, password, beep codes and more.

!BIOS 3.20
a powerfull utility for bios and cmos

DISKMAN4
a powerful all in one utility

UniFlash 1.40
bios flash utility

Kill CMOS
a tiny utility to wipe cmos

Award DMI Configuration Utility 2.43
DMI Configuration utility for modifying/viewing the MIDF contents.

MultiMedia Tools
Picture Viewer 1.94
Picture viewer for dos, supports more then 40 filetypes.

QuickView Pro 2.58
movie viewer for dos, supports many format including divx.

MpxPlay 1.56
a small Music Player for dos

Password Tools
Active Password Changer 3.0.420
To Reset User Password on windows NT/2000/XP/2003/Vista (FAT/NTFS)

Offline NT/2K/XP Password Changer
utility to reset windows nt/2000/xp administrator/user password.

Registry Reanimator 1.02
Check and Restore structure of the Damaged Registry files of NT/2K/XP

NTPWD
utility to reset windows nt/2000/xp administrator/user password.

Registry Viewer 4.2
Registry Viewer/Editor for Win9x/Me/NT/2K/XP

ATAPWD 1.2
Hard Disk Password Utility

TrueCrypt 6.2a
On-the-fly disk encryption tool, can create a virtual encrypted disk within a file and mount it as a real disk, can also encrypt an entire HDD/Partition/USB Drive

Content Advisor Password Remover 1.01
It Removes Content Advisor Password from Internet Explorer

Password Renew 1.1
Utility to (re)set windows passwords

WindowsGate 1.1
Enables/Disables Windows logon password validation

WinKeyFinder 1.73
Allows you to View and Change Windows XP/2003 Product Keys, backup and restore
activation related files, backup Microsoft Office 97, 2000 SP2, XP/2003 keys etc.

XP Key Reader 2.7
Can decode the XP-key on Local or Remote systems

ProduKey 1.36
Recovers lost the product key of your Windows/Office

Wireless Key View 1.27
Recovers all wireless network keys (WEP/WPA) stored in your computer by WZC

MessenPass 1.26
A password recovery tool that reveals the passwords of several instant messangers

Mail PassView 1.51
Recovers mail passwords of Outlook Express, MS Outlook, IncrediMail, Eudora, etc.

Asterisk Logger 1.04
Reveal passwords hidden behind asterisk characters

NTFS (FileSystems) Tools
NTFS Dos Pro 5.0
To access ntfs partitions from Dos

NTFS 4 Dos 1.9
To access ntfs partitions from Dos

Paragon Mount Everything 3.0
To access NTFS, Ext2FS, Ext3FS partitions from dos

NTFS Dos 3.02
To access ntfs partitions from Dos

EditBINI 1.01
to Edit boot.ini on NTFS Partition

Browsers / File Managers
Volkov Commander 4.99
Dos File Manager with LongFileName/ntfs support
(Similar to Norton Commander)

Dos Command Center 5.1
Classic dos-based file manager.

File Wizard 1.35
a file manager - colored files, drag and drop copy, move, delete etc.

File Maven 3.5
an advanced Dos file manager with high speed PC-to-PC file
transfers via serial or parallel cable

FastLynx 2.0
Dos file manager with Pc to Pc file transfer capability

LapLink 5.0
the smart way to transfer files and directories between PCs.

Dos Navigator 6.4.0
Dos File Manager, Norton Commander clone but has much more features.

Mini Windows 98
Can run from Ram Drive, with ntfs support,
Added 7-Zip, Disk Defragmenter, Notepad / RichText Editor,
Image Viewer, .avi .mpg .divx .xvid Movie Player, etc...

Mini Windows Xp
Portable Windows Xp that runs from CD/USB/Ram Drive, with Network and SATA support

7-Zip 4.65
File Manager/Archiver Supports 7z, ZIP, GZIP, BZIP2, TAR, RAR, CAB, ISO, ARJ, LZH, CHM, MSI, WIM, Z, CPIO, RPM, DEB and NSIS formats

Opera Web Browser 8.53
One of the fastest, smallest and smartest full-featured web browser

Other Tools
Ghost Walker 11.5
utility that changes the security ID (SID) for Windows NT, 2000 and XP

DosCDroast beta 2
Dos CD Burning Tools

Universal TCP/IP Network 6.4
MSDOS Network Client to connect via TCP/IP to a Microsoft based
network. The network can either be a peer-to-peer or a server based
network, it contains 91 different network card drivers
HxD 1.7.7.0
Hex Editor provides tools to inspect and edit files, main memory, disks/disk images

Virtual Floppy Drive 2.1
enables you to create and mount a virtual floppy drive on your NT/2000/XP/Vista

Streams 1.56
Reveal/Delete NTFS alternate data streams

NewSID 4.10
utility that changes the security ID (SID) for Windows NT, 2000 and XP

Dos Tools
USB CD-Rom Driver 1
Standard usb_cd.sys driver for cd drive

Universal USB Driver 2
Panasonic v2.20 ASPI Manager for USB mass storage

ASUSTeK USB Driver 3
ASUS USB CD-ROM Device Driver Version 1.00

SCSI Support
SCSI Drivers for Dos

SATA Support
SATA Driver (gcdrom.sys) and JMicron JMB361 (xcdrom.sys) for Dos

1394 Firewire Support
1394 Firewire Drivers for Dos

Interlnk support at COM1
To access another computer from COM port

Interlnk support at LPT1
To access another computer from LPT port

and too many great dos tools
very good collection of dos utilities
extract.exe pkzip.exe pkunzip.exe unrar.exe rar.exe
ace.exe lha.exe gzip.exe uharcd.exe mouse.com
attrib.com deltree.exe xcopy.exe diskcopy.com imgExtrc.exe
undelete.com edit.com fdisk.exe fdisk2.exe fdisk3.exe
lf.exe delpart.exe wipe.com zap.com format.com
move.exe more.com find.exe hex.exe debug.exe
split.exe mem.exe mi.com sys.com smartdrv.exe
xmsdsk.exe killer.exe share.exe scandisk.exe scanreg.exe
guest.exe doskey.exe duse.exe biosdtct.exe setver.exe
intersvr.exe interlnk.exe loadlin.exe lfndos.exe doslfn.com

Cleaners
SpaceMonger 1.4
keeping track of the free space on your computer

WinDirStat 1.1.2.80
a disk usage statistics viewer and cleanup tool for Windows.

CCleaner 2.23.993
Crap Cleaner is a freeware system optimization and privacy tool

Optimizers
PageDfrg 2.32
System file Defragmenter For NT/2k/XP

NT Registry Optimizer 1.1j
Registry Optimization for Windows NT/2000/2003/XP/Vista

DefragNT 1.9
This tool presents the user with many options for disk defragmenting

JkDefrag 3.36
Free disk defragment and optimize utility for Windows 2000/2003/XP/Vista

Network Tools
Angry IP Scanner 2.21
Scan IP addresses in any range as well as any their ports

CurrPorts 1.66
displays the list of all currently opened TCP and UDP ports on your computer

TCPView 2.54
Lists TCP and UDP endpoints, including the Local/Remote addresses of TCP connections

Winsock 2 Fix for 9x
to fix corrupted Winsock2 information by poorly written Internet programs

XP TCP/IP Repair 1.0
Repair your Windows XP Winsock and TCP/IP registry errors

Process Tools
IB Process Manager 1.04
a little process manager for 9x/2k, shows dll info etc.

Process Explorer 11.33
shows you information about which handles and DLLs processes have opened or loaded

OpenedFilesView 1.40
View opened/locked files in your system, sharing violation issues

Pocket KillBox 2.0.0.978
can be used to get rid of files that stubbornly refuse to allow you to delete them

ProcessActivityView 1.10
Detailed process access information read/write/opened files etc

Unlocker 1.8.7
This tool can delete file/folder when you get this message - Cannot delete file:
Access is denied, The file is in use by another program etc.

Registry Tools
RegScanner 1.77
Tool to find/search in the Registry of Windows

Registry Editor PE 0.9c
Easy editing of remote registry hives and user profiles

Registry Restore Wizard 1.0.4
Restores a corrupted system registry from Xp System Restore

Startup Tools
Autoruns 9.53
Displays All the entries from startup folder, Run, RunOnce, and other Registry keys,
Explorer shell extensions,toolbars, browser helper objects, Winlogon notifications,
auto-start services, Scheduled Tasks, Winsock, LSA Providers, Remove Drivers
and much more which helps to remove nasty spyware/adware and viruses.

Silent Runners Revision 59
A free script that helps detect spyware, malware and adware in the startup process

Startup Control Panel 2.8
a tool to edit startup programs

Startup Monitor 1.02
it notifies you when any program registers itself to run at system startup

HijackThis 2.0.2
a general homepage hijackers detector and remover and more

Tweakers
Dial a Fix 0.60.0.24
Fix errors and problems with COM/ActiveX object errors and missing registry entries,
Automatic Updates, SSL, HTTPS, and Cryptography service (signing/verification)
issues, Reinstall internet explorer etc. comes with the policy scanner

Ultimate Windows Tweaker 2.0
A TweakUI Utility for tweaking and optimizing Windows Vista

TweakUI 2.10
This PowerToy gives you access to system settings that are not exposed in the Windows Xp

Xp-AntiSpy 3.97.4 beta
it tweaks some Windows XP functions, and disables some unneeded Windows services quickly

Shell Extensions Manager (ShellExView) 1.40
An excellent tool to View and Manage all installed Context-menu/Shell extensions

EzPcFix 1.0.0.16
Helpful tool when trying to remove viruses, spyware, and malware

RemoveWGA 1.2
Windows Genuine Advantage Notifications Removal tool

RRT - Remove Restrictions Tool 3.0
To Re-enable Ctrl+Alt+Del, Folder Options and Registry tools etc.

Antivirus Tools
Kaspersky Virus Removal Tool 7.0.0.290 (2908)
Free on-demand virus scanner from Kaspersky Lab to remove viruses.

Spybot - Search & Destroy 1.6.2 (2908)
Application to scan for spyware, adware, hijackers and other malicious software.

Malwarebytes' Anti-Malware 1.40 (2908)
anti-malware application that can thoroughly remove even the most advanced malware.

SpywareBlaster 4.2 (2908)
Prevent the installation of spyware and other potentially unwanted software.

SmitFraudFix 2.423
This removes Some of the popular Desktop Hijack malware

ComboFix (2908)
Designed to cleanup malware infections and restore settings modified by malware

CWShredder 2.19
Popular CoolWebSearch Trojan Remover tool

RootkitRevealer 1.7.1
Rootkit Revealer is an advanced patent-pending root kit detection utility.

SuperAntispyware 4.27 (2908)
Remove Malware, Rootkits, Spyware, Adware, Worms, Parasites (a must have tool)

Contenidos:
http://www.hiren.info/pages/bootcd

Arrancar desde USB (pendrive, lápiz de memoria)

USB Booting
http://www.hirensbootcd.net/usb-booting.html

Hiren's BootCD From USB Flash Drive (USB Pen Drive)
http://homepage.ntlworld.com/hiren.thanki/bootcd_on_usb_disk.html

Hiren's Boot CD


Hiren's BootCD 15.1
http://www.hirensbootcd.org/files/Hirens.BootCD.15.1.zip

Filename: Hirens.BootCD.15.1.zip
Filesize: 498.36 MB (522565534 bytes)
ISO MD5: B5DE7A10DD1586D47535372EA1AD9BED

Relacionado:

CDs autoarrancables para casos de emergencia )

Por motivos de optimización y pruebas el buscador del foro volverá a funcionar el Lunes 4 de Septiembre.



Gracias.

cierro el tema, porque no tengo ganas de repetir una vez más, que elhacker.net se registró en el 2001 y años más tarde "copiaron" el nombre del dominio con un guión.

gracias por avisar.

El mensaje ha sido borrado.

[A) Detectando el ataque]

v 2.38

Intentando Detener o mitigar un Ataque de Denegación de Servicio Distribuido

Porque un null-route a una ip no es una solución, es una chapuza.

Si unos script-kiddies están DDoSeando tu web.....

Index:
a) Detectando el ataque

1) Usando el comando netstat
2) Mirando el server-status del Apache
3) Mirando los logs del mod_evasive
4) Mirando los logs del syslog (del kernel)
5) Mirando las gráficas del MRTG, RRDtool, ntopng, Monitorix

B) Intentar parar el ataque

1) - mod_evasive
2) - mod_security
3)  tcplimit, ipdrop, ipblock
4) Optimizando y asegurando la red con el sysctl.conf
5) APF Firewall con el módulo anti-ddos
6) Parar el/la botnet
7) Usando reglas de iptables
8) Usando el mod_throttle
9) DDoS Deflate, Floodmon
10) CloudFlare, Akamai, Incapsula, Arbor, ProjectShield


a) Se basa en ataques reales.
b) No hay nada de teoría, solo parte práctica.

A) Detectando el ataque

1) Usando el comando netstat

Código [Seleccionar] Expandir

netstat -an | grep :80 | sort

Código [Seleccionar] Expandir

netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'

Código [Seleccionar] Expandir

netstat -n -p|grep SYN_REC | wc -l

Código [Seleccionar] Expandir

netstat -lpn|grep :80 |awk '{print $5}'|sort

Código [Seleccionar] Expandir

netstat -an | grep :80 | awk '{ print $5 }' | awk -F: '{ print $1 }' | sort | uniq -c | sort -n

Ejemplo de ataque SYN_RECV o SYN Flooding al Apache (puerto 80).

192.168.0.3 es la ip del servidor apache y 192.168.0.105 es la ip del "atacante".

Código [Seleccionar] Expandir


[..]
tcp        0      0 192.168.0.3:80          192.168.0.5:60808     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60761     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60876     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60946     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60763     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60955     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60765     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60826     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60951     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60942     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61113     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60909     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60822     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60894     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60952     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60928     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60936     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60906     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61466     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60919     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60914     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60926     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60939     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60931     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60831     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60743     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:61076     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60912     SYN_RECV  
tcp        0      0 192.168.0.3:80          192.168.0.5:60816     SYN_RECV
[..]


Claro ejemplo de SYN Attack al Apache.

2) Mirando el server-status del Apache

Si miramos el server-status del apache veremos conexiones en estado "Reading" ("R" Reading Request).



El problema es que cuando el número de conexiones "Reading" llena el "MaxClients" del Apache no acepta nuevas peticiones, por lo que los nuevos clientes, aunque sean legítimos, no serán aceptados.

Podemos aumentar el valor del "MaxClients" para que no se llene la cola de peticiones y acepte a todos los clientes, sean atacantes o no.

Otra buena medida es bajar el valor del "Timeout" del Apache para que las peticiones "Reading" sean "matadas" rápidamente, antes que pueda llenarse el MaxClients a su tope.

Por defecto en Apache:

Código [Seleccionar] Expandir

Timeout 300

Se puede bajar hasta 100 sin problemas, teniendo en cuenta que las conexiones muy lentas pueden tener problemas.

Para aumentar el MaxClients en el fichero httpd.conf Apache 2 basta con añadir la directiva:

ServerLimit 350 antes de MaxClients y ya dejará.

Código [Seleccionar] Expandir

<IfModule prefork.c>
[..]
ServerLimit 500
MaxClients 450
[..]
</IfModule>

Y la directiva ListenBackLog

Código [Seleccionar] Expandir

#por defecto ListenBacklog 511 ataque tcp syn flood
#http://httpd.apache.org/docs/2.0/mod/mpm_common.html#listenbacklog
ListenBackLog 1024

Herramienta Floodmon: alerta, detecta y mitiga ataques SYN Flood
http://blog.elhacker.net/2014/05/floodmon-alerta--detecta-mitiga-ataques-tcp-syn-flood-ip.html

3) Mirando los logs del mod_evasive

Jun 22 18:24:04 lan mod_evasive[3835]: Blacklisting address 82.228.169.50: possible attack.
Jun 22 18:24:45 lan mod_evasive[3600]: Blacklisting address 81.206.164.163: possible attack.
Jun 22 18:25:46 lan mod_evasive[3589]: Blacklisting address 155.232.250.19: possible attack.
Jun 22 18:27:23 lan mod_evasive[3671]: Blacklisting address 83.227.217.2: possible attack.
Jun 22 18:28:10 lan mod_evasive[3673]: Blacklisting address 68.187.171.89: possible attack.
Jun 22 18:29:57 lan mod_evasive[3605]: Blacklisting address 70.143.2.130: possible attack.
Jun 22 18:30:45 lan mod_evasive[3803]: Blacklisting address 69.157.93.88: possible attack.
Jun 22 18:31:45 lan mod_evasive[10397]: Blacklisting address 146.64.81.22: possible attack.
Jun 22 18:35:01 lan mod_evasive[3794]: Blacklisting address 66.38.192.134: possible attack.
Jun 22 18:35:15 lan mod_evasive[3553]: Blacklisting address 81.190.204.64: possible attack.
Jun 22 18:40:10 lan mod_evasive[16602]: Blacklisting address 64.231.39.129: possible attack.
Jun 22 18:48:04 lan mod_evasive[16479]: Blacklisting address 84.99.195.100: possible attack.
Jun 22 18:48:12 lan mod_evasive[16467]: Blacklisting address 201.0.10.142: possible attack.
Jun 22 18:52:57 lan mod_evasive[16573]: Blacklisting address 219.95.39.242: possible attack.
Jun 22 18:53:07 lan mod_evasive[16534]: Blacklisting address 86.129.3.91: possible attack.
Jun 22 18:53:26 lan mod_evasive[16527]: Blacklisting address 62.254.0.32: possible attack.
Jun 22 18:54:41 lan mod_evasive[30473]: Blacklisting address 24.196.199.191: possible attack.
Jun 22 18:55:17 lan mod_evasive[30520]: Blacklisting address 142.161.157.227: possible attack.
Jun 22 18:55:24 lan mod_evasive[30461]: Blacklisting address 65.92.145.133: possible attack.
Jun 22 18:55:33 lan mod_evasive[30509]: Blacklisting address 88.111.227.200: possible attack.
Jun 22 18:56:13 lan mod_evasive[30473]: Blacklisting address 69.199.94.227: possible attack.
Jun 22 18:57:45 lan mod_evasive[30517]: Blacklisting address 86.125.135.212: possible attack.
Jun 22 18:57:54 lan mod_evasive[30479]: Blacklisting address 84.192.141.65: possible attack.
Jun 22 18:58:46 lan mod_evasive[30527]: Blacklisting address 83.140.97.106: possible attack.
Jun 22 18:59:31 lan mod_evasive[30469]: Blacklisting address 82.173.216.196: possible attack.
Jun 22 19:00:33 lan mod_evasive[30517]: Blacklisting address 80.176.157.245: possible attack.
Jun 22 19:00:38 lan mod_evasive[30470]: Blacklisting address 86.133.102.51: possible attack.
Jun 22 19:01:35 lan mod_evasive[30870]: Blacklisting address 24.42.134.253: possible attack.
Jun 22 19:01:48 lan mod_evasive[30509]: Blacklisting address 62.254.0.34: possible attack.
Jun 22 19:02:57 lan mod_evasive[31009]: Blacklisting address 81.227.219.125: possible attack.
Jun 22 19:03:29 lan mod_evasive[31056]: Blacklisting address 172.209.173.153: possible attack.
Jun 22 19:05:07 lan mod_evasive[31385]: Blacklisting address 84.6.12.110: possible attack.
Jun 22 19:06:52 lan mod_evasive[31008]: Blacklisting address 85.227.144.249: possible attack.
Jun 22 19:06:56 lan mod_evasive[31263]: Blacklisting address 213.222.156.222: possible attack.
Jun 22 19:07:13 lan mod_evasive[31393]: Blacklisting address 62.163.143.166: possible attack.
Jun 22 19:07:37 lan mod_evasive[31021]: Blacklisting address 62.135.101.73: possible attack.
Jun 22 19:08:03 lan mod_evasive[31251]: Blacklisting address 82.201.249.69: possible attack.
Jun 22 19:08:17 lan mod_evasive[31200]: Blacklisting address 81.62.65.53: possible attack.
Jun 22 19:11:04 lan mod_evasive[31263]: Blacklisting address 82.39.148.204: possible attack.
Jun 22 19:12:37 lan mod_evasive[31241]: Blacklisting address 213.222.154.13: possible attack.
Jun 22 19:13:54 lan mod_evasive[31027]: Blacklisting address 81.51.79.4: possible attack.
Jun 22 19:24:04 lan mod_evasive[31041]: Blacklisting address 84.221.118.156: possible attack.
Jun 22 19:48:47 lan mod_evasive[3400]: Blacklisting address 62.135.101.192: possible attack.
Jun 22 19:53:04 lan mod_evasive[31031]: Blacklisting address 62.30.33.13: possible attack.
Jun 22 19:54:32 lan mod_evasive[31016]: Blacklisting address 72.14.194.18: possible attack.
Jun 22 19:56:10 lan mod_evasive[31067]: Blacklisting address 198.96.34.58: possible attack.
Jun 22 20:03:24 lan mod_evasive[5144]: Blacklisting address 172.213.33.242: possible attack.
Jun 22 20:08:31 lan mod_evasive[5137]: Blacklisting address 83.241.11.16: possible attack.
Jun 22 20:21:59 lan mod_evasive[6645]: Blacklisting address 201.23.193.20: possible attack.
Jun 22 20:32:28 lan mod_evasive[7801]: Blacklisting address 212.38.134.172: possible attack.
Jun 22 20:45:46 lan mod_evasive[7836]: Blacklisting address 81.247.11.48: possible attack.
Jun 22 20:48:03 lan mod_evasive[7796]: Blacklisting address 70.245.98.186: possible attack.
Jun 22 20:49:38 lan mod_evasive[7832]: Blacklisting address 61.8.138.203: possible attack.
Jun 22 20:51:21 lan mod_evasive[7801]: Blacklisting address 201.132.197.161: possible attack.
Jun 22 20:57:18 lan mod_evasive[10426]: Blacklisting address 82.201.249.67: possible attack.
Jun 22 20:57:51 lan mod_evasive[7822]: Blacklisting address 81.77.26.162: possible attack.
Jun 22 21:00:25 lan mod_evasive[7817]: Blacklisting address 200.39.202.243: possible attack.
Jun 22 21:12:04 lan mod_evasive[7794]: Blacklisting address 84.27.139.25: possible attack.
Jun 22 21:22:27 lan mod_evasive[7816]: Blacklisting address 217.208.98.254: possible attack.

Si es un DDoS muy distribuido enseguida notaremos que muchas ip's diferente DoSean el Apache.

4) Mirando los logs del syslog (del kernel)

May 17 13:39:01 lan kernel: possible SYN flooding on port 80. Sending cookies.
May 17 13:39:02 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:35 lan kernel: NET: 4 messages suppressed.
May 17 13:39:35 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:38 lan kernel: NET: 1 messages suppressed.
May 17 13:39:38 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:43 lan kernel: NET: 6 messages suppressed.
May 17 13:39:43 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:48 lan kernel: NET: 4 messages suppressed.
May 17 13:39:48 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:52 lan kernel: NET: 9 messages suppressed.
May 17 13:39:52 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:39:57 lan kernel: NET: 15 messages suppressed.
May 17 13:39:57 lan kernel: ip_conntrack: table full, dropping packet.
May 17 13:40:01 lan kernel: possible SYN flooding on port 80. Sending cookies.

Líneas a mirar:

possible SYN flooding on port 80. Sending cookies.

"Sending Cookies" si lo tenemos activado en el /etc/sysctl.conf
# Enable TCP SYN Cookie Protection

Código [Seleccionar] Expandir

net.ipv4.tcp_syncookies = 1

A veces es mejor deshabilitarlo:

Código [Seleccionar] Expandir

net.ipv4.tcp_syncookies = 0

De esta manera podemos ver las ip's del ataque:

Jul 14 12:46:50 lan kernel: TCP: drop open request from 80.171.45.81/63069
Jul 14 12:46:55 lan kernel: NET: 1401 messages suppressed.
Jul 14 12:46:55 lan kernel: TCP: drop open request from 80.103.166.148/4403
Jul 14 12:46:59 lan kernel: NET: 1772 messages suppressed.
Jul 14 12:46:59 lan kernel: TCP: drop open request from 200.127.62.215/4019
Jul 14 12:47:05 lan kernel: NET: 2362 messages suppressed.
Jul 14 12:47:05 lan kernel: TCP: drop open request from 85.57.169.142/19899
Jul 14 12:47:11 lan kernel: NET: 2618 messages suppressed.
Jul 14 12:47:11 lan kernel: TCP: drop open request from 83.19.73.122/2710
Jul 14 12:47:14 lan kernel: NET: 898 messages suppressed.
Jul 14 12:47:14 lan kernel: TCP: drop open request from 80.235.39.64/3554
Jul 14 12:47:19 lan kernel: NET: 1120 messages suppressed.
Jul 14 12:47:19 lan kernel: TCP: drop open request from 80.171.45.81/62095
Jul 14 12:47:24 lan kernel: NET: 1714 messages suppressed.
Jul 14 12:47:24 lan kernel: TCP: drop open request from 84.62.152.44/34014
Jul 14 12:47:29 lan kernel: NET: 2274 messages suppressed.
Jul 14 12:47:29 lan kernel: TCP: drop open request from 200.127.62.215/3207
Jul 14 12:47:34 lan kernel: NET: 1552 messages suppressed.
Jul 14 12:47:34 lan kernel: TCP: drop open request from 80.103.166.148/4797
Jul 14 12:47:39 lan kernel: NET: 4044 messages suppressed.
Jul 14 12:47:39 lan kernel: TCP: drop open request from 80.235.39.64/2678
Jul 14 12:47:44 lan kernel: NET: 4360 messages suppressed.
Jul 14 12:47:44 lan kernel: TCP: drop open request from 80.103.166.148/1312
Jul 14 13:04:15 lan kernel: TCP: drop open request from 200.14.237.83/4787
Jul 14 13:04:22 lan kernel: NET: 147 messages suppressed.
Jul 14 13:04:22 lan kernel: TCP: drop open request from 81.38.172.161/4892
Jul 14 13:04:30 lan kernel: NET: 6 messages suppressed.
Jul 14 13:04:30 lan kernel: TCP: drop open request from 200.14.237.83/4934
Jul 14 13:04:30 lan kernel: TCP: drop open request from 200.14.237.83/4935
Jul 14 13:04:38 lan kernel: NET: 76 messages suppressed.
Jul 14 13:04:38 lan kernel: TCP: drop open request from 81.84.212.34/2861
Jul 14 13:04:40 lan kernel: NET: 269 messages suppressed.
Jul 14 13:04:40 lan kernel: TCP: drop open request from 200.14.237.83/3070
Jul 14 13:04:45 lan kernel: NET: 287 messages suppressed.
Jul 14 13:04:45 lan kernel: TCP: drop open request from 81.203.228.102/4400
Jul 14 13:04:50 lan kernel: NET: 98 messages suppressed.
Jul 14 13:04:50 lan kernel: TCP: drop open request from 81.84.212.34/3961
Jul 14 13:04:54 lan kernel: NET: 245 messages suppressed.
Jul 14 13:04:54 lan kernel: TCP: drop open request from 200.84.169.200/1183
Jul 14 13:05:00 lan kernel: NET: 1787 messages suppressed.
Jul 14 13:05:00 lan kernel: TCP: drop open request from 81.203.228.102/2050
Jul 14 13:05:04 lan kernel: NET: 3208 messages suppressed.
Jul 14 13:05:04 lan kernel: TCP: drop open request from 86.212.167.27/4720
Jul 14 13:05:09 lan kernel: NET: 2031 messages suppressed.
Jul 14 13:05:09 lan kernel: TCP: drop open request from 81.203.228.102/1794
Jul 14 13:05:14 lan kernel: NET: 2221 messages suppressed.
Jul 14 13:05:14 lan kernel: TCP: drop open request from 81.38.172.161/4908
Jul 14 13:05:21 lan kernel: NET: 730 messages suppressed.
Jul 14 13:05:21 lan kernel: TCP: drop open request from 81.203.228.102/1430
Jul 14 13:05:25 lan kernel: NET: 234 messages suppressed.
Jul 14 13:05:25 lan kernel: TCP: drop open request from 81.203.228.102/2939
Jul 14 13:05:30 lan kernel: NET: 1594 messages suppressed.
Jul 14 13:05:30 lan kernel: TCP: drop open request from 200.14.237.83/3876
Jul 14 13:05:36 lan kernel: NET: 633 messages suppressed.
Jul 14 13:05:36 lan kernel: TCP: drop open request from 86.212.167.27/1116
Jul 14 13:05:39 lan kernel: NET: 970 messages suppressed.
Jul 14 13:05:39 lan kernel: TCP: drop open request from 81.38.172.161/3040
Jul 14 13:05:45 lan kernel: NET: 548 messages suppressed.
Jul 14 13:05:45 lan kernel: TCP: drop open request from 81.203.228.102/2119
Jul 14 13:05:50 lan kernel: NET: 421 messages suppressed.
Jul 14 13:05:50 lan kernel: TCP: drop open request from 81.203.228.102/2478
Jul 14 13:05:56 lan kernel: NET: 379 messages suppressed.
Jul 14 13:05:56 lan kernel: TCP: drop open request from 81.203.228.102/4005
Jul 14 13:05:59 lan kernel: NET: 891 messages suppressed.
Jul 14 13:05:59 lan kernel: TCP: drop open request from 81.38.172.161/3568
Jul 14 13:06:04 lan kernel: NET: 2221 messages suppressed.
Jul 14 13:06:04 lan kernel: TCP: drop open request from 81.203.228.102/4532
Jul 14 13:06:09 lan kernel: NET: 243 messages suppressed.
Jul 14 13:06:09 lan kernel: TCP: drop open request from 81.203.228.102/1939
Jul 14 13:06:14 lan kernel: NET: 2166 messages suppressed.
Jul 14 13:06:14 lan kernel: TCP: drop open request from 81.38.172.161/2137
Jul 14 13:06:19 lan kernel: NET: 2071 messages suppressed.
Jul 14 13:06:19 lan kernel: TCP: drop open request from 81.38.172.161/3136
Jul 14 13:06:24 lan kernel: NET: 2069 messages suppressed.
Jul 14 13:06:24 lan kernel: TCP: drop open request from 81.84.212.34/4600
Jul 14 13:06:29 lan kernel: NET: 1797 messages suppressed.
Jul 14 13:06:29 lan kernel: TCP: drop open request from 86.212.167.27/3171
Jul 14 13:06:35 lan kernel: NET: 1292 messages suppressed.
Jul 14 13:06:35 lan kernel: TCP: drop open request from 81.203.228.102/1394
Jul 14 13:06:39 lan kernel: NET: 715 messages suppressed.

May 17 14:13:24 lan kernel: ip_conntrack: table full, dropping packet.

Tabla llena. Tenemos un problema porque no admitiremos más conexiones aunque sean legítimas.

Podemos aumentar el valor de dicha tabla si nuestra red da para más.

Directamente:

Código [Seleccionar] Expandir

echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max

Para que el valor quede guardardo y no se pierda al reiniciar, debemos añadirlo en el sysctl.conf

Código [Seleccionar] Expandir

net.ipv4.ip_conntrack_max = 65535

Recuerda reiniciar la red para aplicar los cambios en el /proc (service network restart).

Paquetes Marcianos:

Aug 31 12:41:29 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 12:45:07 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 12:52:57 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 12:58:55 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:08:12 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:12:03 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:34:38 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:37:38 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:52:42 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:56:18 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 13:59:54 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:13:32 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:38:08 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:43:42 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:50:05 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:51:05 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 14:57:58 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 15:05:27 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 15:06:14 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0
Aug 31 15:09:08 lan kernel: martian source 192.168.0.10 from 0.0.0.0, on dev eth0

Son paquetes inesperados que llegan por un camino por el cual no pueden llegar indica algún problema de audacia (cracker).

Usando paquetes como éstos se pueden atacar vulnerabilidades remotas en stacks TCP/IP .

UDP: bad checksum y UDP: short packet

Ataques inundación paquetes UDP seguramente usando reflectores y técnicas de amplificación DrDDoS

http://blog.elhacker.net/2014/06/udp-flood-inundacion-reflection-attack-ataque.html

[..]
Sep  8 15:17:03 ns7 kernel: UDP: bad checksum. From 113.9.245.94:1388 to 108.162.206.73:80 ulen 328
Sep  8 15:17:04 ns7 kernel: UDP: bad checksum. From 113.0.136.151:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:17:04 ns7 kernel: UDP: bad checksum. From 221.208.29.91:1388 to 108.162.206.73:80 ulen 328
Sep  8 15:17:05 ns7 kernel: UDP: bad checksum. From 1.62.206.110:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:17:06 ns7 kernel: UDP: bad checksum. From 1.62.120.124:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:17:06 ns7 kernel: UDP: bad checksum. From 220.192.216.53:1388 to 108.162.206.73:80 ulen 250
Sep  8 15:17:10 ns7 kernel: UDP: bad checksum. From 1.62.206.110:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:17:13 ns7 kernel: UDP: bad checksum. From 221.207.182.119:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:17:13 ns7 kernel: UDP: bad checksum. From 1.190.191.225:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:17:14 ns7 kernel: UDP: bad checksum. From 221.207.218.4:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:17:23 ns7 kernel: UDP: bad checksum. From 113.9.245.94:1388 to 108.162.206.73:80 ulen 250
Sep  8 15:17:23 ns7 kernel: UDP: bad checksum. From 221.207.203.17:1363 to 108.162.206.73:80 ulen 352
Sep  8 15:17:26 ns7 kernel: UDP: bad checksum. From 1.190.191.225:1388 to 108.162.206.73:80 ulen 250
Sep  8 15:17:27 ns7 kernel: UDP: bad checksum. From 221.208.29.91:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:17:29 ns7 kernel: UDP: bad checksum. From 221.208.50.50:1388 to 108.162.206.73:80 ulen 278
Sep  8 15:17:31 ns7 kernel: UDP: bad checksum. From 221.207.182.119:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:17:32 ns7 kernel: UDP: bad checksum. From 221.208.16.42:1388 to 108.162.206.73:80 ulen 296
Sep  8 15:17:35 ns7 kernel: UDP: bad checksum. From 220.192.216.53:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:17:35 ns7 kernel: UDP: bad checksum. From 221.207.182.119:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:17:42 ns7 kernel: UDP: bad checksum. From 220.192.216.53:1388 to 108.162.206.73:80 ulen 296
Sep  8 15:17:42 ns7 kernel: UDP: bad checksum. From 1.62.120.124:1388 to 108.162.206.73:80 ulen 298
Sep  8 15:17:47 ns7 kernel: UDP: bad checksum. From 1.62.120.124:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:17:47 ns7 kernel: UDP: bad checksum. From 1.58.196.127:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:17:48 ns7 kernel: UDP: bad checksum. From 113.9.227.210:1388 to 108.162.206.73:80 ulen 298
Sep  8 15:17:48 ns7 kernel: UDP: bad checksum. From 1.62.206.110:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:17:53 ns7 kernel: UDP: bad checksum. From 113.0.136.151:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:17:59 ns7 kernel: UDP: bad checksum. From 1.190.191.225:1388 to 108.162.206.73:80 ulen 328
Sep  8 15:18:00 ns7 kernel: UDP: bad checksum. From 1.62.206.110:1388 to 108.162.206.73:80 ulen 296
Sep  8 15:18:01 ns7 kernel: UDP: bad checksum. From 221.208.18.228:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:18:04 ns7 kernel: UDP: bad checksum. From 113.0.4.194:1388 to 108.162.206.73:80 ulen 250
Sep  8 15:18:07 ns7 kernel: UDP: bad checksum. From 113.9.227.210:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:10 ns7 kernel: UDP: bad checksum. From 221.208.50.50:1388 to 108.162.206.73:80 ulen 300
Sep  8 15:18:14 ns7 kernel: UDP: bad checksum. From 221.207.182.119:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:18:17 ns7 kernel: UDP: bad checksum. From 113.0.74.11:1388 to 108.162.206.73:80 ulen 296
Sep  8 15:18:17 ns7 kernel: UDP: bad checksum. From 221.212.160.140:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:18 ns7 kernel: UDP: bad checksum. From 113.9.114.231:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:18:18 ns7 kernel: UDP: bad checksum. From 221.208.18.228:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:18 ns7 kernel: UDP: bad checksum. From 1.58.196.127:1388 to 108.162.206.73:80 ulen 296
Sep  8 15:18:20 ns7 kernel: UDP: bad checksum. From 1.190.191.225:1388 to 108.162.206.73:80 ulen 314
Sep  8 15:18:23 ns7 kernel: UDP: bad checksum. From 113.9.146.207:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:25 ns7 kernel: UDP: bad checksum. From 1.62.120.124:1388 to 108.162.206.73:80 ulen 314
Sep  8 15:18:26 ns7 kernel: UDP: bad checksum. From 221.208.18.228:1388 to 108.162.206.73:80 ulen 314
Sep  8 15:18:26 ns7 kernel: UDP: bad checksum. From 113.0.136.151:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:18:26 ns7 kernel: UDP: bad checksum. From 1.190.134.140:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:28 ns7 kernel: UDP: bad checksum. From 1.62.120.124:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:18:29 ns7 kernel: UDP: bad checksum. From 113.9.146.207:1388 to 108.162.206.73:80 ulen 328
Sep  8 15:18:30 ns7 kernel: UDP: bad checksum. From 1.190.191.225:1388 to 108.162.206.73:80 ulen 328
Sep  8 15:18:31 ns7 kernel: UDP: bad checksum. From 221.207.218.4:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:18:35 ns7 kernel: UDP: bad checksum. From 221.207.203.17:4413 to 108.162.206.73:80 ulen 321
Sep  8 15:18:35 ns7 kernel: UDP: bad checksum. From 113.0.189.87:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:36 ns7 kernel: UDP: bad checksum. From 1.190.134.140:1388 to 108.162.206.73:80 ulen 298
Sep  8 15:18:36 ns7 kernel: UDP: bad checksum. From 113.0.74.220:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:36 ns7 kernel: UDP: bad checksum. From 221.208.29.91:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:18:37 ns7 kernel: UDP: bad checksum. From 221.207.182.119:1388 to 108.162.206.73:80 ulen 276
Sep  8 15:18:37 ns7 kernel: UDP: bad checksum. From 221.207.218.4:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:40 ns7 kernel: UDP: bad checksum. From 221.212.160.140:1388 to 108.162.206.73:80 ulen 322
Sep  8 15:18:43 ns7 kernel: UDP: bad checksum. From 113.0.250.3:1388 to 108.162.206.73:80 ulen 334
Sep  8 15:18:43 ns7 kernel: UDP: bad checksum. From 221.208.50.50:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:18:45 ns7 kernel: UDP: bad checksum. From 1.58.196.127:1388 to 108.162.206.73:80 ulen 330
Sep  8 15:18:47 ns7 kernel: UDP: bad checksum. From 221.207.218.4:1388 to 108.162.206.73:80 ulen 296
Sep  8 15:18:48 ns7 kernel: UDP: bad checksum. From 1.62.120.124:1388 to 108.162.206.73:80 ulen 322
[..]

5) Mirando las gráficas del MRTG, RRDtool

Si ves que el tráfico inbound sube hasta los 100mbps es que te están doseando.





Importante mirar la tasa de PPS (packets per second).

En ataques se pueden llegar a más de 100k (100 mil) paquetes por segundo.

Analizar e inspeccionar el tráfico de red (wireshark, tshark, ntopng, tcpdump, iptraf) en busca de patrones o playload.



B) Intentar detener o mitigar un ataque DDoS

1) - mod_evasive

Web Oficial:
http://www.nuclearelephant.com/projects/mod_evasive/

Consideramos que 50 conexiones por segundo a 2 páginas es suficiente motivo como para bloquear esa ip:

Código [Seleccionar] Expandir

<IfModule mod_evasive.c>
   DOSHashTableSize    3097
   DOSPageCount        2
   DOSSiteCount        50
   DOSPageInterval     1
   DOSSiteInterval     1
   DOSBlockingPeriod   900
</IfModule>


Igual que el anterior pero con 50 peticiones en un segundo a 1 sola página:

Código [Seleccionar] Expandir

<IfModule mod_evasive.c>
DOSHashTableSize 3097
DOSPageCount 1
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
</IfModule>


Si queremos bloquear las ips que floodean, podemos usar el iptables:

DOSSystemCommand "sudo -u root -c '/sbin/iptables -A INPUT -s %s -j DROP"

Recordar mirar el syslog por si hay posibles falsos positivos (ip's que no hacian flood).

Para evitar falsos positivos:

Código [Seleccionar] Expandir

<IfModule mod_evasive.c>
# añadir estas líneas que corresponden a rangos de los bots de google
DOSWhitelist 66.249.65.*
DOSWhitelist 66.249.66.*
</IfModule>

Importante:

Para que el mod_evasive funcione correctamente deberás modificar el:

MaxRequestsPerChild 0

Para poner un valor alto pero nunca ilimitado (0).

MaxRequestsPerChild 10000

Config ejemplo:
http://www.eth0.us/mod_evasive

2 - mod_security

El único problema del mod_security es que necesitamos al menos un argumento para detectar el ataque.

En el ejemplo usamos en http_referer y el User Agent para detectar el DDoS:

Bloqueando un ataque Iframe
http://foro.elhacker.net/seguridad/bloqueando_un_ataque_iframe-t127481.0.html

3- tcplimit, ipdrop, ipblock

Usando firewalls dinámicos.

4- Optimizando y asegurando la red con el sysctl.conf


cat /proc/sys/net/ipv4/tcp_syncookies

Código [Seleccionar] Expandir


   # Enable IP spoofing protection, turn on Source Address Verification

   net.ipv4.conf.all.rp_filter = 1

   # Enable TCP SYN Cookie Protection

   net.ipv4.tcp_syncookies = 1

   # Enable ignoring broadcasts request
   
   net.ipv4.icmp_echo_ignore_broadcasts = 1


1). Activate SynCookies protection

   It works by sending out 'syncookies' when the
   syn backlog queue of a socket overflows.

   => echo 1 >/proc/sys/net/ipv4/tcp_syncookies

   or

   => /sbin/sysctl -w net.ipv4.tcp_syncookies=1

2). Disable source routing

   => for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
   echo 0 > $f
   done

   or

   => /sbin/sysctl -w net.ipv4.conf.all.accept_source_route=0

3). Reverse Path Filtering

   Reject incoming packets if their source address doesn't match
   the network interface that they're arriving on

   => for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
   echo 1 > $f
   done

   or

   => /sbin/systcl -w net.ipv4.conf.all.rp_filter=1

4). Log RP filter dropped packets (martians)

   => for f in /proc/sys/net/ipv4/conf/*/log_martians; do
   echo 1 > $f
   done

   or

   => /sbin/sysctl -w net.ipv4.conf.all.log_martians=1

5). Maximal number of remembered connection requests

   => /sbin/sysctl -w net.ipv4.tcp_max_syn_backlog=256

6). How may times to retry before killing TCP connection

   (default 7 on most systems)

   => /sbin/sysctl -w net.ipv4.tcp_orphan_retries=4

7). Number of SYN packets the kernel will send before giving up

   => /sbin/sysctl -w net.ipv4.tcp_syn_retries=5

8). Disable broadcast icmp reply

   => /sbin/sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

9). Ignore Bogus icmp packets

   => /sbin/sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

10). Disable ICMP redirect

   => echo 0 >/proc/sys/net/ipv4/conf/all/accept_redirects
   => echo 0 >/proc/sys/net/ipv4/conf/all/send_redirects

   or

   => /sbin/sysctl -w net.ipv4.conf.all.accept_redirects=0
   => /sbin/sysctl -w net.ipv4.conf.all.send_redirects=0

11). Disable timestamps

   => echo 0 >/proc/sys/net/ipv4/tcp_timestamps

   or

   => /sbin/sysctl -w net.ipv4.tcp_timestamps=0

12). Reduce DOS ability by reducing timeouts

   => echo 30 >/proc/sys/net/ipv4/tcp_fin_timeout
   => echo 1800 >/proc/sys/net/ipv4/tcp_keepalive_time
   => echo 0 >/proc/sys/net/ipv4/tcp_window_scaling
   => echo 0 >/proc/sys/net/ipv4/tcp_sack

   or

   => /sbin/sysctl -w net.ipv4.tcp_fin_timeout=30
   => /sbin/sysctl -w net.ipv4.tcp_keepalive_time=1800
   => /sbin/sysctl -w net.ipv4.tcp_window_scaling=0
   => /sbin/sysctl -w net.ipv4.tcp_sack=0

- Lista de todas las variables del TCP: (Lista de Variables del /proc/sys/net/ipv4/* (con varlores por defecto y explicaciones))
http://www.frozentux.net/ipsysctl-tutorial/ipsysctl-tutorial.html

- Optimizando el kernel de linux mediante tuning y hardering sysctl.conf
http://wiki.elhacker.net/sistemas-operativos/gnulinux/tuning-sysctl-conf

- Opciones de seguridad en Linux a través de /proc (I) y (II)
http://www.elhacker.net/opciones-seguridad-linux-proc.html

Más ejemplos de configuración completa del sysctl.conf en las referencias del documento.

5- APF Firewall con el módulo anti-ddos

Código [Seleccionar] Expandir

wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
tar xvzf apf-current.tar.gz
cd apf-0.9.6-1/
./install.sh

service apf start
/usr/local/sbin/apf -s

Fichero de configuración:

/etc/apf/conf.apf

Despues de hacer las pruebas dejar:
DEVEL_MODE="0"

Si nos sale un error parecido a este:
apf(9413): unable to load iptables module (ip_tables), aborting.

Cambiamos esto:
SET_MONOKERN="1"

Puertos que queremos abrir (inbound)
IG_TCP_CPORTS="21,22,25,53,80,110"

Si queres bloquear todo el tráfico de salida lo ponemos en 1 (outbound)
EGF="0"

Si queremos usar el módulo antddos poner a 1:
USE_AD="0"

Log:
/var/log/apf_log

Para ver los paquetes que dropeamos:
LOG_DROP="1"

Lo guardará en el syslog, ejemplo:

Proto= Protocolo
SRC= ip origen
SPT= Source Port (puerto d origen)
DST= Destination Port (puerto destino)

Oct 20 13:59:27 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=18779 PROTO=TCP SPT=11629 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:16 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20376 PROTO=TCP SPT=27734 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:17 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20382 PROTO=TCP SPT=25943 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:17 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20387 PROTO=TCP SPT=19026 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:17 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20397 PROTO=TCP SPT=2155 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:17 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20407 PROTO=TCP SPT=9294 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:22 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20687 PROTO=TCP SPT=9269 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:22 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20694 PROTO=TCP SPT=27223 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:23 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=20830 PROTO=TCP SPT=30938 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:25 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=21038 PROTO=TCP SPT=5377 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:27 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=21219 PROTO=TCP SPT=13341 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:00:42 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=21990 PROTO=TCP SPT=22960 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0
Oct 20 14:02:32 ns2 kernel: ** SANITY ** IN=eth0 OUT=  SRC=213.27.201.254 DST=192.168.0.3 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=26386 PROTO=TCP SPT=2826 DPT=80 WINDOW=0 RES=0x00 RST FIN URGP=0

Recuerda que para usar el antidos debes añadir el cron job:

*/8 * * * * root /etc/apf/ad/antidos -a >> /dev/null 2>&1

http://www.r-fx.org/apf/README.antidos

KISS My Firewall es una alternativa.

Script PHP
http://www.prism-hosting.com/AntiDoS

6- Parar el botnet

ZmbScap - Zombie Scapper - Stoopt DDoS Programs
http://www.metaeye.org/projects/zmbscap/

Tracking Botnets - Bot-Commands
http://www.honeynet.org/papers/bots/botnet-commands.html

Tracking Botnets
http://www.honeynet.org/papers/bots/

Tracking Botnets - DDoS-attacks
http://www.honeynet.org/papers/bots/botnet-ddos.html

Phatbot Trojan Analysis
http://www.lurhq.com/phatbot.html

F-Bot by f-secure- Elimina el Agobot y todas sus variantes
http://www.f-secure.com/tools/f-bot.zip

Nepenthes - Autoinfecarse sin peligro para analizar
http://nepenthes.mwcollect.org/

honeytrap – trap attacks against tcp services
http://honeytrap.sourceforge.net/

7) Usando reglas del iptables

- Los paquetes del DDoS (Ataque de denegación de servicio distribuido) podrían venir de cualquier parte del mundo

Podemos limitar con iptables el tráfico udp

Código [Seleccionar] Expandir

   
# Limitar el UDP flood
# Crear la cadena para UDP flood
iptables -N cadena-udp-flood
# Saltar a la cadena cuando el UDP es detectado
iptables -A INPUT -p  udp -j cadena-udp-flood
# Limitar la velocidad UDP  a 10/segundos con limite de 20
iptables -A cadena-udp-flood -m limit – -limit 10/s – -limit-burst 20 -m comment – -comment "Limite velocidad UDP" -j RETURN
# Logear
iptables -A cadena-udp-flood -m limit – -limit 6/h – -limit-burst 1 -j LOG – -log-prefix "Probable udp flood "
# Baneados durante 5 minutos los que más floodean
iptables -A cadena-udp-flood -m recent – -name blacklist_300 – -set -m comment – -comment "BlackList origen IP" -j DROP  


Módulo limit (iptables)

Diferencias entre limit y limit burst

Usando el módulo limit

-m limit

Podemos hacer uso de limit y limit burst

Código [Seleccionar] Expandir

    iptables -I FORWARD -p udp -m limit --limit 200/s --limit-burst -j DROP

Con --limit se especifica una media (average), no un caudal. Por ejemplo: decir 200/s (200 por segundo) puede significar que en el primer minuto se reciben 50 paquetes y en el segundo también 50 o puede significar que en el primer minuto se reciben 100 y en el segundo 50... la media sigue siendo 200/segundo.

El limite puede ser

   /second (/s)
   /minute (/m)
   /hour (/h)
   /day (/d)

--limit-burst especifica un máximo, si no se especifica un --limit-burst por defecto vale 5 y significa que se aceptaran los primeros 5 paquetes y luego se esperara hasta alcanzar la media para seguir aceptando.

Módulo Recent (iptables)

El módulo de IPTables recientes tiene algunas limitaciones. Por defecto, sólo hace un seguimiento de las 100 más recientes 100 IPs, y los últimos diez paquetes de cada una. Si tienes una gran cantidad de direcciones IP de origen de golpe, estos límites pueden no ser suficientes.

Código [Seleccionar] Expandir


# todo el trafico syn
-P INPUT DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
-A INPUT -m state --state INVALID -j DROP
-P OUTPUT DROP
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
-A OUTPUT -m state --state INVALID -j DROP
-P FORWARD DROP
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p tcp ! --syn -j REJECT --reject-with tcp-reset
-A FORWARD -m state --state INVALID -j DROP
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A FORWARD -i lo -o lo -j ACCEPT


# sube las cargas pero muchos wwww buena señal
-A INPUT -p tcp --syn -j REJECT --reject-with icmp-port-unreachable



# la que mejor va
-N syn-flood
-A syn-flood -m limit --limit 100/second --limit-burst 150 -j RETURN
-A syn-flood -j LOG --log-prefix "SYN flood: "
-A syn-flood -j DROP



# igual que el de arriba pero muy bestia
-N syn-flood
-A INPUT -i eth0:2 -p tcp --syn -j syn-flood
-A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
-A syn-flood -j DROP


-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit
1/sec -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit
--limit 1/sec -j ACCEPT

# no es muy efectivo
-A INPUT -s 0/0 -p tcp --syn --source-port 1000:5000
--destination-port 80 -j DROP

# no es muy efectivo
-A INPUT -p tcp -m tcp --dport 80 --sport 1000:5000 --tcp-flags SYN SYN -j DROP

# Descartar paquetes mal formados

-N PKT_FAKE
-A PKT_FAKE -m state --state INVALID -j DROP
-A PKT_FAKE -p tcp --dport 80 --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
-A PKT_FAKE -p tcp --dport 80 --tcp-flags SYN,FIN SYN,FIN -j DROP
-A PKT_FAKE -p tcp --dport 80 --tcp-flags SYN,RST SYN,RST -j DROP
-A PKT_FAKE -p tcp --dport 80 ! --syn -m state --state NEW -j DROP
-A PKT_FAKE -f -j DROP
-A PKT_FAKE -j RETURN

# syn-flood
-N syn-flood
-A INPUT -i eth+ -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j syn-flood
-A FORWARD -i eth+ -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j syn-flood
-A syn-flood -m limit --limit 4/s --limit-burst 16 -j RETURN
-A syn-flood -m limit --limit 75/s --limit-burst 100 -j RETURN
-A syn-flood -j LOG --log-prefix "SYN FLOOD " --log-tcp-sequence  --log-tcp-options  --log-ip-options -m limit --limit 1/second
-A syn-flood -j DROP

# By pepel. Requiere módulo "recent"
-A INPUT -p tcp --dport 80 -m state --state NEW -m recent   --set
-A INPUT -p tcp --dport 80 -m state --state NEW -m recent  --update --seconds 10 --hitcount 10 -j DROP

#explicación:
Se añade cada ip que se conecte a la tabla de recent
Por por cada ip en la tabla de recent si hace mas de x hits en x segundos, se dropea.


iptables -I INPUT -p tcp –syn -m recent –set
iptables -I INPUT -p tcp –syn -m recent –update –seconds 10 –hitcount 30 -j DROP

UDP Flood

/sbin/iptables -A OUTPUT -p udp -m state --state NEW -j ACCEPT
/sbin/iptables -A OUTPUT -p udp -m limit --limit 100/s -j ACCEPT
/sbin/iptables -A OUTPUT -p udp -j DROP

Lo que hace es contar el número de paquetes SYN (inicio de conexión TCP) para
cada dirección IP en los últimos 10 segundos. Si llega a 30 descarta ese paquete por
lo que no se establecerá la conexión (el TCP volverá a intentar varias veces,
cuando baje del límite podrá establecerse).


8) Limitar el ancho de banda servidor web

http://www.snert.com/Software/mod_throttle/

Limitar ancho de banda en Apache

Limitar ancho de banda en Apache

mod_bandwidth para Apache versión/rama 1.3.x
   mod_bw para Apache versión/rama 2.x
   mod_cband para Apache2
   mod_ratelimit para Apache 2.4.x y 2.5.x
   mod_qos  para Apache 2 (quality of service (QoS))

Otros:

Mod_Throttle, mod_bandwidth, mod_iplimit, mod_tsunami, mod_limitipconn.c

Para Apache 2:
mod_cband

Código [Seleccionar] Expandir

cd /usr/src
wget http://www.snert.com/Software/mod_throttle/mod_throttle312.tgz
tar zxvf mod_throttle312.tgz
cd mod_throttle-3.1.2
pico Makefile
Then edit the line that reads:
APXS=apxs
And change it to read:
APXS=/usr/local/apache/bin/apxs
make
make install
service httpd restart


<IfModule mod_throttle.c>
ThrottlePolicy Volume 10G 30d
</IfModule>
<Location /throttle-me>
SetHandler throttle-me
</Location>

http://www.webhostgear.com/160.html

9) Script herramienta Floodmon Floodmon o Script herramienta DDoS Deflate

http://blog.elhacker.net/2013/12/ddos-deflate-script-bash-para-mitigar-ataques-ddos-dos.html

http://blog.elhacker.net/2014/05/floodmon-alerta--detecta-mitiga-ataques-tcp-syn-flood-ip.html

10) Usar sistemas gratuitos como CloudFlare

Servicios basados en una gran infraestructura de red que incluyen técnicas de mitigación pro-activas, filtrado e inspección de paquetes

Funcionamiento y configuración protección DDoS de CloudFlare

el foro está sufriendo un ataque DDoS que en breve será solucionado.

Lamento y pido disculpas por el mal funcionamiento del foro durante los dos últimos días.

Un poco de paciencia. Gracias.

pondremos un anuncio en un diario para buscar moderador jejeje

[temas nuevos]

Uno de los discos duros de servidor del foro ha fallado y una de las tablas del foro ha quedado corrupta (inservible).

Se ha vuelto a restaurar un backup de dicha tabla del día 12 de agosto (sábado). Por este motivo, los temas nuevos (new topics) esritos ayer día 13 de Agosto (domingo) y hoy lunes se han perdido.

Las respuestas a  los mensajes deberían estar todas, así como los mensajes privados.

Si no encuentras tu mensaje, siéntete libre de volver a formular tu pregunta de nuevo en el foro correspondiente.

Gracias.

Disculpad las molestias.