Home / server / Questions / 323687
In Process
Isaac
Asked: 2011-10-22 08:25:48 +0800 CST

Block outgoing LOIC attacks in a network

  • 772

I am admin of a small network. Users in our network have access to internet through a squid NAT server.

Recently, we have detected that some users are using LOIC to attack servers on the internet. How can I detect and block such attacker automatically?

Is there any straightforward way for this (e.g. blocking an especial port or pattern?) Or I have to use a intelligent software that detects misbehavior of our users and blocks them?

A temporary IP-based blocking is sufficient for us.

firewall ddos

1 Answers

  1. mailq's comment isn't so much anarchist as it is the Right Answer for Most Cases.

    If users are using corporate (or school, etc) resources to perform illegal activity (whether it is on the Internet or not), appropriate measures should be taken to let them know that this is completely unacceptable.

    Nobody should be anonymous on your network, you should be able to easily track it down to a specific computer (DHCP lease) and most likely a specific user.

    Given all that, The Spiderlabs Blog has an article on snort rules to detect LOIC activity. Implementing snort may be your best option if you really can't address the problem through education or a LART.

    Ben's comment brings up a whole 'nother can of worms. Consider:

    1. Does this expose the network owner to liability if illegal activities are conducted?
    2. How open do things really need to be? Can you open HTTP/HTTPS-only? Can you rate-limit?
    3. On a large network (such as a hospital) you may be better off with a commercial hardware IDS/firewall.
    • 4