{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood od Google ili kako ne li\u0161iti sve Youtube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jedne divne proljetne ve\u010deri, kada nisam \u017eelio i\u0107i ku\u0107i, a neumoljiva \u017eelja za \u017eivotom i otkrivanjem me obuzimala poput u\u017earenog \u017eeljeza, pojavila se ideja da istra\u017eim privla\u010dnu opciju na vatrozidu pod nazivom «IP DOS politika<\/b>«.
\nNakon uvodnih priprema i upoznavanja s priru\u010dnikom, postavio sam u na\u010dinu Pass-and-Log<\/b>, da bih uop\u0107e vidio ishod i sumnjivu korisnost ovog pode\u0161avanja.
\nNakon nekoliko dana (da se statistika nakupi, naravno, a ne zato \u0161to sam zaboravio) pogledao sam u logove i, ple\u0161u\u0107i na mjestu, zapljeskao dlanovima \u2014 skupilo se zapisa do iznad glave. \u010cinilo bi se, \u0161to je lak\u0161e \u2014 uklju\u010di politiku u na\u010din blokiranja svih koji spamiraju, skeniraju, postavljaju half-open<\/b> sesije s banom na sat i spavaj mirno s spoznajom da je granica zaklju\u010dana. Ali 34. godina \u017eivota pre\u0161la je mladena\u010dki maksimalizam i negdje na stra\u017enjem dijelu mozga za\u010duo se tihi glasi\u0107: \"Hajde da otvorimo o\u010di i pogledamo \u010dije adrese na\u0161 omiljeni firewall prepoznaje kao zle spamera? Tako, u skladu s ludostima.\"
\n<\/a><\/noindex>
\nPo\u010dinjemo analizirati prikupljene podatke s liste anomalija. Prolazim adrese kroz jednostavni skript Powershell<\/b> i o\u010di mi zapnu za poznate znakove google<\/b>. <\/p>\n

\"UDP
\n
\nTrljam o\u010di, trep\u0107u\u0107i pet minuta, kako bih se uvjerio da mi se ne privi\u0111a \u2014 doista na listi onih koje je firewall smatrao zlim spamerom, tip napada \u2014 udp flood<\/b>, adrese pripadaju korporaciji dobra. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\n\u010cesam se po zatiljku, istovremeno pode\u0161avaju\u0107i na vanjskom su\u010delju snimanje paketa za kasniju analizu. U mislima prolaze \u0161arene misli: \u201eKako to, ne\u0161to zara\u017eeno u opsegu Google-a? I to sam otkrio ja? Pa to je, to je \u2014 nagrade, po\u010dasti i crveni tepih, i svoje kasino s blackjackom i, znate ve\u0107...\u201c<\/p>\n

Analiziram dobivenu datoteku Wireshark<\/b>-om.
\nDa, doista s adrese iz opsega Google <\/b>\u0161alju UDP pakete s 443 porta na nasumi\u010dni port na mom ure\u0111aju.
\nAli, stani malo\u2026 Evo protokol se mijenja s UDP<\/b> na GQUIC<\/b>.
\nSemen Semenovi\u010d\u2026<\/p>\n

\"UDP
\n
\nOdmah se sjetim izlaganja s HighLoad <\/b>Aleksandra Tobolja<\/u> \u00abUDP<\/b> protiv TCP<\/b> ili budu\u0107nost mre\u017enog stoga»(link<\/a><\/noindex>).
\nS jedne strane, dolazi do blagog razo\u010daranja \u2014 ni ti, gospodaru, lovorika, ni po\u010dasti. S druge strane, problem je jasan, ostaje razumjeti kamo i koliko kopati.
\nNekoliko minuta razgovora s Korporacijom Dobrote \u2013 i sve dolazi na svoje mesto. U poku\u0161aju pobolj\u0161anja brzine isporuke sadr\u017eaja, kompanija Google <\/b>jo\u0161 2012. godine najavila je protokol QUIC<\/b>, koji omogu\u0107ava uklanjanje velikog broja nedostataka TCP-a (da, da, da, u ovim \u010dlancima \u2013 Bam<\/a><\/noindex><\/b> i Dva<\/a><\/noindex><\/b> govori se o potpuno revolucionarnom pristupu, ali, budimo iskreni, svi \u017eelimo da se slike ma\u010daka u\u010ditavaju br\u017ee, a ne sve te va\u0161e revolucije svesti i napretka). Kako je pokazalo daljnje istra\u017eivanje, mnoge organizacije trenutno prelaze na ovakav na\u010din isporuke sadr\u017eaja.
\nProblem u mom slu\u010daju, a verujem i u mnogim drugim, je u tome \u0161to na kraju dolazi previ\u0161e paketa, a vatrozid ih percipira kao spam.
\nRe\u0161enja su se pokazala kao malo:
\n1. Dodati u izuzetak za DoS politiku<\/b> na vatrozidu opseg adresa Google<\/b>. Pri samoj pomisli na opseg mogu\u0107ih adresa, oko je po\u010delo nervozno da trep\u0107e \u2013 ideja je odlo\u017eena kao besmislena.
\n2. Pove\u0107ati prag aktivacije za udp flood politiku<\/b> \u2013 tako\u0111e nije re\u0161enje, a \u0161ta ako nekome stvarno padne na pamet da napadne.
\n3. Zabrana poziva iz unutra\u0161nje mre\u017ee prema UDP <\/b>na 443 <\/b>spoljnom portu.
\nNakon dodatnog prou\u010davanja implementacije i integracije QUIC <\/b>u Google Chrome<\/b> prihva\u0107en je kao akcija poslednja opcija. Stvar je u tome \u0161to, svima omiljeni bezobzirno (ne razumem za\u0161to, ve\u0107u bi te\u017einu imala siva ma\u010dka Firefox<\/b>-ova nju\u0161ka koja bi dobijala za potro\u0161ene gigabajte RAM-a), Google Chrome<\/b> prvo poku\u0161ava uspostaviti vezu koriste\u0107i svoj iscrpljeni QUIC<\/b>, ali ako \u010dudo ne uspe, vra\u0107a se proverenim metodama kao \u0161to su TLS<\/b>, iako se srami toga. <\/p>\n

Kreiramo na vatrozidu zapis za uslugu QUIC<\/b>:<\/p>\n

\"UDP
\n
\nPodesimo novo pravilo i stavimo ga negde vi\u0161e u lancu.<\/p>\n

\"UDP
\n
\nNakon aktiviranja pravila, na spisku anomalija mir i ti\u0161ina, osim za stvarno zle prestupnike.<\/p>\n

\"UDP
\n
\nHvala svima na pa\u017enji.<\/p>\n

Kori\u0161\u0107eni resursi:<\/b><\/u>
\n1.Izve\u0161taj Aleksandra Tobolja<\/a><\/noindex>
\n2.Opis QUIC protokola od kompanije Infopulse<\/a><\/noindex>
\n3.Vikipedija<\/a><\/noindex>
\n4. KB od Fortineta<\/a><\/noindex>
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood od Google ili kako ne uskra\u0107ivati sve Youtube | ProHoster","description":"Jedne divne prole\u0107ne ve\u010deri, kada nisam \u017eeleo da idem ku\u0107i, a nesputana \u017eelja za \u017eivotom i u\u010denjem svrbela je i pekla kao u\u017eareni gvo\u017e\u0111e, pojavila se ideja da se pozabavim zavodljivom funkcijom na vatrozidu pod nazivom.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}