40. DoS and DDoS – Availability Attacks
40.7 Detection and Defence Stack
Layered availability defence (ek tool nahi):
| Layer | What | Why |
|---|---|---|
| Monitoring / baselines | bps, PPS, RPS, latency, 5xx rate | You cannot fight what you do not see |
| Border / ISP / cloud scrubbing | Absorb volumetric junk upstream | Origin pipe is small |
| Anycast CDN | Spread attack across many PoPs | Classic large-site pattern |
| WAF / bot management | App-layer floods and scrapers | Cheap HTTP hurts origin |
| Origin rate limits + timeouts | nginx/Apache limits | Last line on your VM |
| Firewalld / ufw basics | Drop unexpected; rate modules where available | Host-only lab + prod alike |
| Architecture | Cache, queue, degrade gracefully | Fail soft, not black hole forever |
# firewalld example on Amazon Linux / CentOS-class lab YOU own
sudo yum install -y firewalld
sudo service firewalld start
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
# Ubuntu: sudo apt install ufw && sudo ufw allow 80/tcp && sudo ufw enable
# Always: rules first in lab snapshot; don't lock yourself out of SSH without console
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Multi-vector (UDP + SYN + HTTP) | Multi-layer scrub + WAF + origin limits |
| Rotates bot IPs | Behaviour / JA3 / challenge; not only static IP blocklists |
| Hopes SME has no on-call | Runbook + ISP/CDN contacts printed for Rani |
Ravindra Bagale's Tip
"We put Cloudflare in front, so we're 100% safe" – say students, and sometimes bosses. An origin IP leak = the CDN is bypassed. Hide the origin; allowlist only the CDN ranges on the firewall where the design fits. Interview: describe a stack, not a single product name.
Ravindra Bagale's Tip – मराठी
"Cloudflare लावला = 100% safe" – students आणि कधी कधी bosses. Origin IP leak = CDN bypass. Origin लपवा; design बसत असेल तिथे firewall वर फक्त CDN ranges allowlist करा. Interview: stack सांगा, एकाच product चे नाव नाही.
Ravindra Bagale's Tip – हिंदी
"Cloudflare लगा दिया = 100% safe" – students और कभी-कभी bosses. Origin IP leak = CDN bypass. Origin छिपाओ; जहाँ design fit हो वहाँ firewall पर सिर्फ़ CDN ranges allowlist करो. Interview: stack बताओ, एक product का नाम नहीं.
Lab
Draw defence stack diagram for Sahyadri Traders web shop: user → CDN/WAF → origin nginx 192.168.56.40 (lab). List 5 metrics Shahrukh (fictional SOC) watches. Enable firewalld/ufw on the origin VM; confirm Kali can still hit port 80 host-only; confirm random other ports closed.