Idle connections on a firewall

[dsr-mzpnVDyJpH4k7aNtvndDlA at public.gmane.org (Dan Ritter)]

On Thu, Aug 20, 2009 at 03:26:24PM -0400, Matt Shields wrote:
> One of my networks has a pretty high amount of sustained traffic due to we
> host a lot of domains (as high as 850k connections per second ~60Mbits/sec
> average).  Over the years we've seen a lot of DDOS traffic that opens a port
> and just holds open the connection.  We've come up with quite a few custom
> scripts that run on the firewall (linux/iptables) to use tcpdump to analyze
> the traffic and tell us what IPs are causing the most traffic to hit us ased
> on packet size, as well as another script that can tell us which domain is
> getting hit the most.  But is there a way using tcpdump (or another tool) to
> show what the idle connections are? I realize that tcpdump is made for
> inspecting the packets of traffic and new connections, and in this case it's
> just someone opening a port and keeping it open.

Inspect your DNAT table?

> Second question, once I have a list of these IPs and ports, is there an way
> to drop that connection without affecting all the other valid traffic.  I
> just want to close that one connection.

You can fake TCP FIN packets in each direction. You can add a
temporary rule to DROP packets from both sides -- after 180
seconds, they should have closed their connections.

-dsr-

-- 
http://tao.merseine.nu/~dsr/eula.html is hereby incorporated by reference.
You can't defend freedom by getting rid of it.