{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"Google'i UDP Flood v\u00f5i kuidas mitte kaotada k\u00f5iki Youtube'i","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dchel kaunil kevad\u00f5htul, kui koju ei tahtnud minna, ja kustumatu soov elada ja teadmisi omandada kiusas ning p\u00f5letas nagu kuum raud, s\u00fcndis m\u00f5te nuputada veidi ahvatlevat funktsiooni tulekahjus\u00fcsteemis nimega «IP DOS poliitika<\/b>«.
\nP\u00e4rast eelnevaid m\u00e4ngulisi ettevalmistusi ja kasutusjuhendiga tutvumist seadistasin re\u017eiimi Pass-and-Log<\/b>, et n\u00e4ha, mis v\u00e4ljund \u00fcldse on ja kui kahtlane on selle seadistuse kasulikkus.
\nM\u00f5ne p\u00e4eva p\u00e4rast (et statistika koguneks, loomulikult, mitte seet\u00f5ttu, et unustasin) vaatasin logisid ja, kohapeal tantsides, plaksutasin k\u00e4si \u2014 kirjeid oli kogunenud hulgi. Tundub, et pole midagi lihtsamat \u2014 l\u00fclita poliitika sisse, et blokeerida k\u00f5ik floodijad, skannerid, kes loovad half-open<\/b> sessioonid \u00fche tunni keeldumisega ja maga rahulikult teadmisega, et piir on lukus. Kuid 34. eluaasta \u00fcletas nooruslikud maksimaalsused ja kusagil kuklas plahvatas peen h\u00e4\u00e4l: \u201eAga t\u00f5stame silmalau ja vaatame, kelle aadresse meie kallis tulem\u00fc\u00fcr selleks ajaks rikkaid floodijaid \u00e4ra tundis? Noh, \u00e4\u00e4rmuslikkuse korras.\u201d
\n<\/a><\/noindex>
\nAlustame saadud andmete anal\u00fc\u00fcsimise anomaaliate nimekirjast. K\u00e4in aadresse l\u00e4bi lihtsa skripti. Powershell<\/b> ja silmad j\u00e4\u00e4vad tuttavatele t\u00e4htedele pidama. google<\/b>. <\/p>\n

\"Google'i
\n
\nH\u00f5\u00f5run silmi, pilgutan viis minutit, et veenduda, et mul ei ole n\u00e4gemish\u00e4ire \u2014 t\u00f5epoolest on loendis need, kelle tulem\u00fc\u00fcr on pidanud laskuma pahatahtlikuks sp\u00e4mmijaks, r\u00fcnnakut\u00fc\u00fcp \u2014 udp flood<\/b>, aadressid, mis kuuluvad headuse korporatsioonile. <\/p>\n

\"Google'i
\n\"Google'i
\n\"Google'i
\n\"Google'i
\n
\nKratsin kukalt, samal ajal seadistades v\u00e4lisel liidesel pakettide p\u00fc\u00fcdmiseks seadistusi edasise anal\u00fc\u00fcsi jaoks. Peas keerlevad v\u00e4rvilised m\u00f5tted: \u201eKuidas on see v\u00f5imalik, et midagi nakatunud on Google'i haardes? Ja selle avastasin mina? See on ju, see on ju \u2014 auhinnad, kiitus ja punane vaip, ning oma kasiino mustriga ja, noh, te m\u00f5istate…\u201d<\/p>\n

L\u00e4hen l\u00e4bi saadud faili Wireshark<\/b>-ga.
\nJah, t\u00f5epoolest, aadressilt ulatub Google <\/b>UDP paketid 443-pordilt juhuslikule pordile minu seadmes.
\nAga, oota-oota... Protokoll vahetub UDP<\/b> j\u00e4rgnevaga GQUIC<\/b>.
\nSemen Semenovich...<\/p>\n

\"Google'i
\n
\nTuleb kohe meelde Alex Tobilevi ettekannet HighLoad <\/b>Aleksander Tobilev<\/u> \u00abUDP<\/b> vastu TCP<\/b> v\u00f5i tuleviku v\u00f5rgu pileti»(link<\/a><\/noindex>).
\n\u00dchest k\u00fcljest on kerge pettumus \u2014 ei midagi auhindu, ei austust. Teisest k\u00fcljest on probleem selge, tuleb ainult m\u00f5ista, kuhu ja kui palju kaevata.
\nM\u00f5ned minutid suhtlemist Headuse Korporatsiooniga \u2014 ja k\u00f5ik paigutub oma kohtadele. \u00dcritades parandada sisu edastamise kiirus, ettev\u00f5te Google <\/b>teatas juba 2012. aastal protokollist QUIC<\/b>, mis k\u00f5rvaldab suurima osa TCP puudustest (jah-jaa-jaa, nendes artiklites \u2014 T\u00f5epoolest<\/a><\/noindex><\/b> ja Kaks<\/a><\/noindex><\/b> r\u00e4\u00e4gitakse t\u00e4iesti revolutsioonilisest l\u00e4henemisest, kuid olgem ausad, tahaks, et kassipiltide laadimine oleks kiirem, mitte need k\u00f5ik teie teaduse ja arengu revolutsioonid). Kuidas j\u00e4rgnevad uuringud n\u00e4itasid, liiguvad paljud organisatsioonid n\u00fc\u00fcd sellise sisu edastamise variandi juurde.
\nProbleem minu ja, ma arvan, et mitte ainult minu puhul, osutus olevat selles, et pakette on l\u00f5puks liiga palju ja tulem\u00fc\u00fcr tajub neid kui r\u00fcnnakut.
\nLahendusi osutus olema veidi:
\n1. Lisada tulem\u00fc\u00fcri DoS poliitika erandite nimekirja aadressi vahemik DoS Policy<\/b> aadresside vahemikiga Google<\/b>. Ainult m\u00f5te v\u00f5imalike aadresside vahemikust pani mu silma n\u00e4rviliselt v\u00e4risema \u2014 see idee on edasi l\u00fckatud kui jabur.
\n2. T\u00f5sta k\u00e4ivitustase udp \u00fclekoormuse poliitika<\/b> \u2014 pole samuti normaalne, aga mis siis, kui m\u00f5ni t\u00f5eliselt pahatahtlik inimene l\u00e4bi lipsab.
\n3. Keelata p\u00f6\u00f6rdumised sisev\u00f5rgust UDP <\/b>j\u00e4rgnevaga 443 <\/b>v\u00e4listele portidele.
\nLugedes rohkem rakenduse ja integreerimise kohta QUIC <\/b>\u00fches Google Chrome<\/b> v\u00e4ideti, et viimane variant on tegevusjuhis. Asi on selles, et, armastatud k\u00f5igi poolt laialdaselt ja raevukalt (ma ei saa aru, miks, parem oleks, kui see h\u00e4bematult punane Firefox<\/b>-ova n\u00e4gu saaks karistust rasvaamortiseerimise eest), Google Chrome<\/b> \u00fcritab algselt luua \u00fchendust oma vaeva n\u00e4inud QUIC<\/b>, kuid kui imet ei toimu, siis ta p\u00f6\u00f6rdub tagasiv\u00e4\u00e4rsete meetodite juurde, nagu n\u00e4iteks TLS<\/b>, ehkki ta h\u00e4beneb seda kohutavalt. <\/p>\n

Loome tulem\u00fc\u00fcri jaoks teenuse kirje QUIC<\/b>:<\/p>\n

\"Google'i
\n
\nSeadistame uue reegli ja paigutame selle ahelas kuskile k\u00f5rgemale.<\/p>\n

\"Google'i
\n
\nP\u00e4rast reegli sissel\u00fclitamist anomaaliate loendis on rahu ja vaikuses, v\u00e4lja arvatud t\u00f5eliselt t\u00f5sised rikkujad.<\/p>\n

\"Google'i
\n
\nAit\u00e4h k\u00f5igile t\u00e4helepanu eest.<\/p>\n

Kasutatud allikad:<\/b><\/u>
\n1.Alexander Tobol'i ettekanded<\/a><\/noindex>
\n2.QUIC protokolli kirjeldus ettev\u00f5ttelt Infopulse<\/a><\/noindex>
\n3.Vikipeedia<\/a><\/noindex>
\n4. Fortinet'i KB<\/a><\/noindex>
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood Google'ilt v\u00f5i kuidas mitte j\u00e4tta k\u00f5iki Youtube'i | ProHoster","description":"\u00dchel kaunil kevade \u00f5htul, kui koju minna ei tahtnud ja pidev elujanu hele ja p\u00f5lev nagu kuum raud, tekkis idee uurida ahvatlevat funktsiooni tulem\u00fc\u00fcris, mille nimi on.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}