| Jugurtha BELKALEM | c77b158 | 2019-01-22 19:20:55 +0100 | [diff] [blame] | 1 | Demonstrations of dddos.py, the Linux eBPF/bcc version. |
| 2 | |
| 3 | This tracks ip_rcv function (using kprobe) and elapsed time |
| 4 | between received packets to detect potential DDOS attacks. |
| 5 | |
| 6 | The following steps illustrates the usage of dddos : |
| 7 | 1 - Start dddos.py : |
| 8 | # ./dddos.py |
| 9 | DDOS detector started ... Hit Ctrl-C to end! |
| 10 | TIME(s) MESSAGE |
| 11 | |
| 12 | 2 - Launch hping3 (or any other flooder) in another terminal as shown below: |
| 13 | # hping3 localhost -S -A -V -p 443 -i u100 |
| 14 | |
| 15 | 3 - dddos.py triggers alerts and reports a DDOS attack: |
| 16 | DDOS detector started ... Hit Ctrl-C to end! |
| 17 | TIME(s) MESSAGE |
| 18 | 2019-01-16 11:55:12.600734 DDOS Attack => nb of packets up to now : 1001 |
| 19 | 2019-01-16 11:55:12.600845 DDOS Attack => nb of packets up to now : 1002 |
| 20 | 2019-01-16 11:55:12.600887 DDOS Attack => nb of packets up to now : 1003 |
| 21 | 2019-01-16 11:55:12.600971 DDOS Attack => nb of packets up to now : 1004 |
| 22 | 2019-01-16 11:55:12.601009 DDOS Attack => nb of packets up to now : 1005 |
| 23 | 2019-01-16 11:55:12.601062 DDOS Attack => nb of packets up to now : 1006 |
| 24 | 2019-01-16 11:55:12.601096 DDOS Attack => nb of packets up to now : 1007 |
| 25 | 2019-01-16 11:55:12.601195 DDOS Attack => nb of packets up to now : 1008 |
| 26 | 2019-01-16 11:55:12.601228 DDOS Attack => nb of packets up to now : 1009 |
| 27 | 2019-01-16 11:55:12.601331 DDOS Attack => nb of packets up to now : 1010 |
| 28 | 2019-01-16 11:55:12.601364 DDOS Attack => nb of packets up to now : 1011 |
| 29 | 2019-01-16 11:55:12.601470 DDOS Attack => nb of packets up to now : 1012 |
| 30 | 2019-01-16 11:55:12.601505 DDOS Attack => nb of packets up to now : 1013 |
| 31 | 2019-01-16 11:55:12.601621 DDOS Attack => nb of packets up to now : 1014 |
| 32 | 2019-01-16 11:55:12.601656 DDOS Attack => nb of packets up to now : 1015 |
| 33 | 2019-01-16 11:55:12.601757 DDOS Attack => nb of packets up to now : 1016 |
| 34 | 2019-01-16 11:55:12.601790 DDOS Attack => nb of packets up to now : 1017 |
| 35 | 2019-01-16 11:55:12.601892 DDOS Attack => nb of packets up to now : 1018 |
| 36 | 2019-01-16 11:55:12.601925 DDOS Attack => nb of packets up to now : 1019 |
| 37 | 2019-01-16 11:55:12.602028 DDOS Attack => nb of packets up to now : 1020 |
| 38 | |
| 39 | Remark : Use Ctrl-C to stop dddos.py |