1, source IP address filtering
Filtering source IP addresses at all ISP network access or aggregation nodes can effectively reduce or eliminate source IP address fraud, and make various DDoS attacks such as SMURF and TCP-SYNflood impossible to implement.
2. Flow restriction
Controlling certain types of traffic, such as ICMP, UDP and TCP-SYN, at network nodes and limiting their sizes to a reasonable level can reduce the impact of denial of DDoS attacks on the host network and the target network.
3.ACL filtering
Filter the traffic of worm attack port and DDoS tool control port without affecting the business.
4.TCP interception
In view of TCP-SYNflood attack, the user can consider enabling the TCP interception function of the gateway device to resist. Because turning on TCP interception function may have a certain impact on router performance, it should be considered comprehensively when using this function.
Ddos protection method?
1, DDoS network attack protection: When faced with a large number of SYNFlood, UDPFlood, DNSFlood and ICMPFlood attacks, it can quickly block the attack source and ensure the normal operation of the business.
2. Disaster tolerance of domain name resolution dysfunction: When the root domain and top-level domain servers can't serve normally, or even the external authorization servers all fail, a company's next-generation firewall DNS proxy system can still provide normal domain name resolution services as an isolated island.
3.DNS security policy linkage: track and monitor the resolution requests of key domains/domain names, start relevant security linkage measures in case of abnormal situation, and only respond to normal domain names.
4.DNS amplification attack protection: When the traffic of an IP suddenly increases abnormally, it will automatically start IP analysis and security linkage measures to limit the speed of the IP and trim the response results, effectively preventing the DNS server from becoming the source of amplification attacks.
5. Multi-line traffic scheduling disaster tolerance: For customers with multi-line exports, different export strategies can be configured.
6. Weak credential perception: When legitimate users log in to various application management systems through weak passwords, they will be intelligently perceived and informed by security administrators that there is a security risk of weak passwords, thus improving the security level of accounts.
7. Vulnerability attack protection: When attackers list password violence or system vulnerabilities that attack enterprise information assets, they can quickly detect attacks and form effective defense.
8. Botnet detection: When employees in an organization receive malware through instant messaging tools or e-mail, they can quickly detect the malware in the process of communicating with the outside world, thus effectively protecting the internal information of the organization from being leaked.
9.APT targeted attack detection: A company's next-generation firewall can effectively detect APT targeted attacks, zero-day attacks and malware during transmission through various traffic identification algorithms, and keep APT attacks out.
What is the protection ability of sk high-security servers in the United States?
The SK computer room in the United States has four data centers, including Los Angeles, Denver, Chicago and Amsterdam. Most machines provide IPMI, and users can install the operating system and switch it on and off by themselves.
Rich in IP resources, each server can provide up to 5 high-security IPS for free, and can be added to up to 254 IPS. The SK computer room in the United States was upgraded to CN2 hybrid line, and the domestic access speed was faster. The default bandwidth was G port. The US SK computer room provides DDoS cluster firewall free of charge, and provides DDOS protection up to 40 Gbps, which can be upgraded to 100Gbps protection. When attacked, it will not close, stop or block the server port. The SK computer room in the United States adopts multi-line redundancy, and the international lines mainly include Comcast, Cogent, Zayo, GTT, China Unicom and China Telecom, maintaining a connectivity rate of 99.9999%.