Entre em contato com seu ISP e forneça estas informações. Eles precisarão diminuir o tráfego no backbone. Quando o tráfego atingir seu firewall, os recursos já estarão sendo consumidos. A única maneira de impedir isso é soltá-lo no backbone.
Estamos sob um pesado ataque de icmp flood. O tcpdump mostra o resultado abaixo. Embora tenhamos bloqueado o ICMP com o iptables, o tcpdump ainda imprime pacotes icmp. Eu também anexei a configuração do iptables e o resultado "top". Existe alguma coisa que eu possa fazer para parar completamente os pacotes icmp?
[root@server downloads]# tcpdump icmp -v -n -nn
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
03:02:47.810957 IP (tos 0x0, ttl 49, id 16007, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 124, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.811559 IP (tos 0x0, ttl 49, id 16010, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 52, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.811922 IP (tos 0x0, ttl 49, id 16012, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 122, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.812485 IP (tos 0x0, ttl 49, id 16015, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 126, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.812613 IP (tos 0x0, ttl 49, id 16016, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 122, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.812992 IP (tos 0x0, ttl 49, id 16018, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 122, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.813582 IP (tos 0x0, ttl 49, id 16020, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 52, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.814092 IP (tos 0x0, ttl 49, id 16023, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 120, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.814233 IP (tos 0x0, ttl 49, id 16024, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 120, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.815579 IP (tos 0x0, ttl 49, id 16025, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 50, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.815726 IP (tos 0x0, ttl 49, id 16026, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
IP (tos 0x0, ttl 50, id 31864, offset 0, flags [none], proto: ICMP (1), length: 76) 77.92.136.196 > 94.201.175.188: [|icmp]
03:02:47.815890 IP (tos 0x0, ttl 49, id 16027, offset 0, flags [none], proto: ICMP (1), length: 56) 80.227.64.183 > 77.92.136.196: ICMP redirect 94.201.175.188 to host 80.227.64.129, length 36
Configuração do iptables:
[root@server etc]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ofis tcp -- anywhere anywhere tcp dpt:mysql
ofis tcp -- anywhere anywhere tcp dpt:ftp
DROP icmp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DROP icmp -- anywhere anywhere
Chain ofis (2 references)
target prot opt source destination
ACCEPT all -- OUR_OFFICE_IP anywhere
DROP all -- anywhere anywhere
top:
top - 03:12:19 up 400 days, 15:43, 3 users, load average: 1.49, 1.67, 2.61
Tasks: 751 total, 3 running, 748 sleeping, 0 stopped, 0 zombie
Cpu(s): 8.2%us, 1.0%sy, 0.0%ni, 87.9%id, 2.1%wa, 0.1%hi, 0.7%si, 0.0%st
Mem: 32949948k total, 26906844k used, 6043104k free, 4707676k buffers
Swap: 10223608k total, 0k used, 10223608k free, 14255584k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
36 root 39 19 0 0 0 R 100.8 0.0 17:03.56 ksoftirqd/11
10552 root 15 0 11408 1460 676 R 5.7 0.0 0:00.04 top
7475 lighttpd 15 0 304m 22m 15m S 3.8 0.1 0:05.37 php-cgi
1294 root 10 -5 0 0 0 S 1.9 0.0 380:54.73 kjournald
3574 root 15 0 631m 11m 5464 S 1.9 0.0 0:00.65 node
7766 lighttpd 16 0 302m 19m 14m S 1.9 0.1 0:05.70 php-cgi
10237 postfix 15 0 52572 2216 1692 S 1.9 0.0 0:00.02 scache
1 root 15 0 10372 680 572 S 0.0 0.0 0:07.99 init
2 root RT -5 0 0 0 S 0.0 0.0 0:16.72 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0.0 0.0 1:10.46 migration/1
6 root 34 19 0 0 0 S 0.0 0.0 0:01.11 ksoftirqd/1
7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
8 root RT -5 0 0 0 S 0.0 0.0 2:36.15 migration/2
9 root 34 19 0 0 0 S 0.0 0.0 0:00.19 ksoftirqd/2
10 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/2
11 root RT -5 0 0 0 S 0.0 0.0 3:48.91 migration/3
12 root 34 19 0 0 0 S 0.0 0.0 0:00.20 ksoftirqd/3
13 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/3
uname -a
[root@server etc]# uname -a
Linux thisis.oursite.com 2.6.18-238.19.1.el5 #1 SMP Fri Jul 15 07:31:24 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux
arp -an
[root@server downloads]# arp -an
? (77.92.136.194) at 00:25:90:04:F0:90 [ether] on eth0
? (192.168.0.2) at 00:25:90:04:F0:91 [ether] on eth1
? (77.92.136.193) at 00:23:9C:0B:CD:01 [ether] on eth0
Estes parecem ser Redirecionamentos do ICMP .
Normalmente, eles são apenas em um segmento de rede local.
Qual IP é seu? 80,227.64,183 > 77.92.136.196: Redirecionamento ICMP 94.201.175.188 para hospedar 80.227.64.129
Eu li (possivelmente incorretamente) isso para dizer que um gateway em seu segmento de rede 80.227.64.183 está lhe dizendo (77.92.136.196) para chegar a 94.201.175.188 através de 80.227.64.129 ??
Parece que há algum tráfego de VLAN sobreposto no seu segmento de rede. (o que você arp tabelas parecem? arp -an)
Você provavelmente não deseja aceitar redirecionamentos de ICMP no seu roteador de borda. Eu não recomendaria deixar cair ICMP completamente, though. Tente adicionar estas regras:
iptables -N ICMP
iptables -A ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A ICMP -p icmp --icmp-type source-quench -j ACCEPT
iptables -A ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
iptables -A ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A ICMP -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A ICMP -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp -j ICMP
E como o @MDMarra já disse, você provavelmente deve entrar em contato com o seu ISP sobre isso.
Vá para /etc/csf/csf.conf
No estado ping do ICMP para 0 e proíbe o ping externo.