{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood od Google nebo jak neobratit v\u0161echny na Youtube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jednoho kr\u00e1sn\u00e9ho jarn\u00edho ve\u010dera, kdy\u017e se necht\u011blo j\u00edt dom\u016f a nezkrotn\u00e1 touha \u017e\u00edt a pozn\u00e1vat m\u011b svrb\u011bla a p\u00e1lila jako \u017ehaven\u00e9 \u017eelezo, p\u0159i\u0161la mi na mysl my\u0161lenka prozkoumat l\u00e1kavou funkci na firewallu s n\u00e1zvem «IP DOS policy<\/b>«.
\nPo \u00favodn\u00edch p\u0159\u00edprav\u00e1ch a prostudov\u00e1n\u00ed manu\u00e1lu jsem nastavil re\u017eim Pass-and-Log<\/b>, abych se pod\u00edval, jak\u00fd bude v\u00fdstup a pochybn\u00e1 u\u017eite\u010dnost tohoto nastaven\u00ed.
\nPo p\u00e1r dnech (aby se statistiky nashrom\u00e1\u017edily, samoz\u0159ejm\u011b, a ne proto, \u017ee bych zapomn\u011bl) jsem se pod\u00edval do log\u016f a tleskal jsem, sk\u00e1kaje na m\u00edst\u011b \u2014 byly tam z\u00e1znamy a\u017e a\u017e. Zd\u00e1lo by se, \u017ee co m\u016f\u017ee b\u00fdt jednodu\u0161\u0161\u00ed \u2014 zapni pravidlo v re\u017eimu blokov\u00e1n\u00ed v\u0161ech, kte\u0159\u00ed flooduj\u00ed, skenuj\u00ed, zakl\u00e1daj\u00ed half-open<\/b> sestavy s banem na hodinu a m\u016f\u017ee\u0161 sp\u00e1t v klidu s v\u011bdom\u00edm, \u017ee hranice je pod z\u00e1mkem. Ale t\u0159ic\u00e1t\u00fd \u010dtvrt\u00fd rok \u017eivota p\u0159etla\u010dil mladistv\u00fd maximalismus a kdesi na z\u00e1tylku se ozval jemn\u00fd hl\u00e1sek: \u201eA co \u0159\u00edk\u00e1\u0161 na to, pod\u00edvat se, kter\u00e9 adresy n\u00e1\u0161 milovan\u00fd firewall rozpoznal jako zlo\u010dinn\u00e9 floodery? No, tak pro jistotu.\u201c
\n<\/a><\/noindex>
\nZa\u010d\u00edn\u00e1me analyzovat z\u00edskan\u00e9 \u00fadaje se seznamem anom\u00e1li\u00ed. Proch\u00e1z\u00edm adresy skrze jednoduch\u00fd skript Powershell<\/b> a o\u010di nar\u00e1\u017eej\u00ed na zn\u00e1m\u00e1 p\u00edsmena google<\/b>. <\/p>\n

\"UDP
\n
\nT\u0159u si o\u010di, mrk\u00e1m p\u011bt minut, abych se ujistil, \u017ee se mi to nezd\u00e1 \u2014 ve skute\u010dnosti je na seznamu t\u011bch, kter\u00e9 firewall pova\u017eoval za zlo\u010dinn\u00e9 floodery, typ \u00fatoku \u2014 udp flood<\/b>, adresy pat\u0159\u00edc\u00ed korporaci dobra. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\n\u0160kr\u00e1bu se na z\u00e1tylku, p\u0159itom nastavuj\u00edc\u00ed na extern\u00edm rozhran\u00ed zachyt\u00e1v\u00e1n\u00ed paket\u016f pro n\u00e1slednou anal\u00fdzu. V hlav\u011b mi prob\u00edhaj\u00ed duhov\u00e9 my\u0161lenky: \u201eJak je to mo\u017en\u00e9, \u017ee n\u011bco infikovan\u00e9ho je ve skopu Google? A to jsem objevil j\u00e1? To je p\u0159ece \u2014 odm\u011bny, pocty a \u010derven\u00fd koberec, a vlastn\u00ed kasino s blackjackem a, no ch\u00e1pete…\u201c<\/p>\n

Rozb\u00edr\u00e1m z\u00edskan\u00fd soubor Wireshark<\/b>-em.
\nAno, skute\u010dn\u011b, z adresy ze sf\u00e9ry Google <\/b>p\u0159ich\u00e1zej\u00ed UDP pakety z portu 443 na n\u00e1hodn\u00fd port na m\u00e9m za\u0159\u00edzen\u00ed.
\nAle, po\u010dkejte\u2026 Tady se protokol m\u011bn\u00ed z UDP<\/b> na GQUIC<\/b>.
\nSemjon Semjonovi\u010d\u2026<\/p>\n

\"UDP
\n
\nOkam\u017eit\u011b si vzpom\u00edn\u00e1m na zpr\u00e1vu z HighLoad <\/b>Alexandra Toboly<\/u> \u201eUDP<\/b> proti TCP<\/b> nebo budoucnost s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku»(link<\/a><\/noindex>).
\nNa jedn\u00e9 stran\u011b p\u0159ich\u00e1z\u00ed m\u00edrn\u00e9 zklam\u00e1n\u00ed \u2014 ani laure\u00e1ty, ani poct. Na druhou stranu, probl\u00e9m je jasn\u00fd, zb\u00fdv\u00e1 pochopit, kam a kolik kopat.
\nP\u00e1r minut komunikace s Korporac\u00ed Dobr\u00e9 \u2014 a v\u0161echno zapadne na sv\u00e1 m\u00edsta. V pokusu o zlep\u0161en\u00ed rychlosti doru\u010dov\u00e1n\u00ed obsahu spole\u010dnost Google <\/b>ji\u017e v roce 2012 ozn\u00e1mila protokol QUIC<\/b>, kter\u00fd umo\u017e\u0148uje odstranit v\u011bt\u0161inu nedostatk\u016f TCP (ano, ano, ano, v t\u011bchto \u010dl\u00e1nc\u00edch \u2014 Ha<\/a><\/noindex><\/b> a Dva<\/a><\/noindex><\/b> se hovo\u0159\u00ed o zcela revolu\u010dn\u00edm p\u0159\u00edstupu, ale bu\u010fme up\u0159\u00edmn\u00ed, cht\u011blo by to, aby se fotky ko\u010dek na\u010d\u00edtaly rychleji, a ne ty va\u0161e revoluce v my\u0161len\u00ed a pokroku). Jak uk\u00e1zal dal\u0161\u00ed v\u00fdzkum, \u0159ada organizac\u00ed nyn\u00ed p\u0159ech\u00e1z\u00ed na podobn\u00fd zp\u016fsob doru\u010dov\u00e1n\u00ed obsahu.
\nProbl\u00e9m v m\u00e9m a, jak si mysl\u00edm, nejen m\u00e9m p\u0159\u00edpad\u011b byl v tom, \u017ee paket\u016f nakonec jde opravdu hodn\u011b a firewall je vn\u00edm\u00e1 jako flood.
\nMo\u017enost\u00ed \u0159e\u0161en\u00ed bylo m\u00e1lo:
\n1. P\u0159idat do seznamu v\u00fdjimek pro DoS Policy<\/b> na firewallu rozsah adres Google<\/b>. P\u0159i pouh\u00e9 my\u0161lence na rozsah mo\u017en\u00fdch adres se mi za\u010dalo nerv\u00f3zn\u011b t\u0159\u00e1st oko \u2014 my\u0161lenka byla odlo\u017eena jako bl\u00e1zniv\u00e1.
\n2. Zvednout prah pro aktivaci pro udp flood policy<\/b> \u2014 tak\u00e9 nekomilfo, a co kdy\u017e se n\u011bkdo skute\u010dn\u011b zl\u00fd prosm\u00fdkne.
\n3. Zak\u00e1zat p\u0159\u00edstupy z vnit\u0159n\u00ed s\u00edt\u011b po UDP <\/b>na 443 <\/b>portu ven.
\nPo dal\u0161\u00edm prostudov\u00e1n\u00ed realizace a integrace QUIC <\/b>v Google Chrome<\/b> byla p\u0159ijata jako pokyn k akci posledn\u00ed varianta. Skute\u010dnost je takov\u00e1, \u017ee, milovan\u00fd v\u0161emi nekompromisn\u011b (nech\u00e1pu pro\u010d, rad\u011bji by se m\u011bla dost\u00e1vat pokuta nastrkan\u00e1 kr\u00e1sn\u011b oran\u017eovou Firefox<\/b>-ovou tv\u00e1\u0159\u00ed za pr\u016fb\u011b\u017en\u011b spot\u0159ebovan\u00e9 gigabajty opera\u010dn\u00ed pam\u011bti), Google Chrome<\/b> p\u016fvodn\u011b se pokou\u0161\u00ed nav\u00e1zat spojen\u00ed pomoc\u00ed sv\u00e9ho trp\u011bliv\u011b vybojovan\u00e9ho QUIC<\/b>, ale pokud je z\u00e1zrak neuskute\u010dnen, vrac\u00ed se k osv\u011bd\u010den\u00fdm metod\u00e1m, jako je TLS<\/b>, i kdy\u017e se toho kv\u016fli provin\u011bn\u00fdm velice styd\u00ed. <\/p>\n

Na firewallu vytv\u00e1\u0159\u00edme z\u00e1znam pro slu\u017ebu QUIC<\/b>:<\/p>\n

\"UDP
\n
\nNastavujeme nov\u00e9 pravidlo a umis\u0165ujeme ho n\u011bkam v\u00fd\u0161e v \u0159et\u011bzci.<\/p>\n

\"UDP
\n
\nPo aktivaci pravidla v seznamu anom\u00e1li\u00ed ticho a klid, krom\u011b opravdu zlovoln\u00fdch poru\u0161ovatel\u016f.<\/p>\n

\"UDP
\n
\nD\u011bkuji v\u0161em za pozornost.<\/p>\n

Pou\u017eit\u00e9 zdroje:<\/b><\/u>
\n1.Zpr\u00e1va Alexandra Toboly<\/a><\/noindex>
\n2.Popis protokolu QUIC od spole\u010dnosti Infopulse<\/a><\/noindex>
\n3.Wikipedia<\/a><\/noindex>
\n4. KB od Fortinet<\/a><\/noindex>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood od Google nebo jak neochudit v\u0161echny o Youtube | ProHoster","description":"Jednoho kr\u00e1sn\u00e9ho jarn\u00edho ve\u010dera, kdy se necht\u011blo j\u00edt dom\u016f, a neukojiteln\u00e1 touha \u017e\u00edt a pozn\u00e1vat svrb\u011bla a p\u00e1lila jako roz\u017ehaven\u00e9 \u017eelezo, se zrodil n\u00e1pad pohr\u00e1t si s l\u00e1kavou novinkou na firewallu s n\u00e1zvem.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}