{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood a Google-t\u00f3l \u00e9s hogyan ne fossza meg az \u00f6sszes Youtube-ot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Egy gy\u00f6ny\u00f6r\u0171 tavaszi est\u00e9n, amikor nem akartam hazamenni, \u00e9s a sz\u00edvembe t\u00fczes v\u00e1gy \u00e9gett az \u00e9let ir\u00e1nt, felmer\u00fclt az \u00f6tlet, hogy belen\u00e9zzek egy vonz\u00f3 t\u0171zfal-kieg\u00e9sz\u00edt\u0151be, amelyet \"IP DOS politika<\/b>A «ALTER TABLE» \u00e9s «RENAME TABLE» m\u0171veletekben t\u00e1mogat\u00e1sra ker\u00fclt a «IF EXISTS» felt\u00e9tel, amely lehet\u0151v\u00e9 teszi az oper\u00e1ci\u00f3 v\u00e9grehajt\u00e1s\u00e1t a t\u00e1bla l\u00e9tez\u00e9se eset\u00e9n.
\nMiut\u00e1n el\u0151zetesen megk\u00edn\u00e1ltam magam \u00e9s \u00e1tn\u00e9ztem a k\u00e9zik\u00f6nyvet, be\u00e1ll\u00edtottam a k\u00f6vetkez\u0151 \u00fczemm\u00f3dban Pass-and-Log<\/b>, hogy egy\u00e1ltal\u00e1n l\u00e1thassam, milyen eredm\u00e9nyeket \u00e9s mennyire k\u00e9rd\u00e9ses ez a be\u00e1ll\u00edt\u00e1s.
\nP\u00e1r nap eltelt\u00e9vel (hogy a statisztika felgy\u00fclemljen, term\u00e9szetesen, nem az\u00e9rt, mert elfelejtettem) megn\u00e9ztem a napl\u00f3kat, \u00e9s \u00f6r\u00f6mmel tapsoltam \u2014 a bejegyz\u00e9sek \u00f6sszegy\u0171ltek, amire nem sokan sz\u00e1m\u00edtottak. \u00dagy t\u0171nik, hogy mi lehet enn\u00e9l k\u00f6nnyebb \u2014 egyszer\u0171en aktiv\u00e1ld a politik\u00e1t, ami blokkolja az \u00f6sszes spamel\u0151, szkennel\u0151, telep\u00edt\u0151 half-open<\/b> sessions with a one-hour ban and sleep peacefully, knowing that the border is secure. But at 34, youthful maximalism has faded, and a thin voice echoed somewhere in the back of my mind: \u2018Why don\u2019t we lift the veil and see which addresses our beloved firewall has recognized as notorious spammers? Just out of curiosity.\u2019
\n<\/a><\/noindex>
\nKezdj\u00fck elemezni az anom\u00e1li\u00e1k list\u00e1j\u00e1n kapott adatokat. \u00c1tmegyek az c\u00edmeken egy egyszer\u0171 szkripten Powershell<\/b> \u00e9s a szemeim egy ismer\u0151s feliratra bukkannak google<\/b>. <\/p>\n

\"UDP
\n
\nFerk\u00e9lem a szemem, \u00f6t percig pislogok, hogy megbizonyosodjak arr\u00f3l, hogy nem t\u00e9vedek \u2014 t\u00e9nyleg a t\u0171zfal \u00e1ltal gy\u0171jt\u00f6tt spammer c\u00edmek k\u00f6z\u00f6tt szerepel, a t\u00e1mad\u00e1s t\u00edpusa \u2014 udp flood<\/b>, olyan c\u00edmek, amelyek a \u201ej\u00f3 sz\u00e1nd\u00e9k\u00fa\u201d v\u00e1llalathoz tartoznak. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\nA fejem b\u00fabj\u00e1t vakarom, mik\u00f6zben be\u00e1ll\u00edtom a k\u00fcls\u0151 interf\u00e9szen a csomagok r\u00f6gz\u00edt\u00e9s\u00e9t a k\u00e9s\u0151bbi elemz\u00e9shez. A fejemben sziv\u00e1rognak a sziv\u00e1rv\u00e1nyos gondolatok: \"Hogy lehet, hogy valami fert\u0151z\u00f6tt a Google hat\u00e1sk\u00f6r\u00e9ben? \u00c9s ezt \u00e9n fedeztem fel? Ez nem lehet m\u00e1s, mint d\u00edjak, kit\u00fcntet\u00e9sek, v\u00f6r\u00f6s sz\u0151nyeg, \u00e9s a saj\u00e1t kaszin\u00f3m, blackjackkel, \u00e9s tudod, hogyan folytat\u00f3dik...\"<\/p>\n

Elemzem a kapott f\u00e1jlt Wireshark<\/b>-kal.
\nIgen, val\u00f3ban a Google k\u00f6r\u00e9nek c\u00edm\u00e9r\u0151l Google <\/b>UDP csomagokat k\u00fcldenek a 443-as portt\u00f3l egy v\u00e9letlenszer\u0171 portra az eszk\u00f6z\u00f6m\u00f6n.
\nDe v\u00e1rj egy kicsit\u2026 Itt a protokoll v\u00e1lt egy UDP<\/b> Gyorsan eml\u00e9kezz\u00fcnk vissza, hogyan m\u0171k\u00f6dik a modul\u00e1ris aritmetika. Az \u00f3ra m\u00e1r egy ismert koncepci\u00f3. Az \u00f3r\u00e1k haszn\u00e1lata GQUIC<\/b>.
\nSemen Semenyich\u2026<\/p>\n

\"UDP
\n
\nAzonnal eszembe jut egy el\u0151ad\u00e1s a HighLoad <\/b>Alekszandr Tobolr\u00f3l<\/u> \u201eUDP<\/b> a TCP<\/b> vagy a h\u00e1l\u00f3zati stack j\u00f6v\u0151je\"(link<\/a><\/noindex>).
\nEgyr\u00e9szt egy kis csal\u00f3d\u00e1s \u00e9r \u2014 se bab\u00e9r, se kit\u00fcntet\u00e9s. M\u00e1sr\u00e9szt a probl\u00e9ma vil\u00e1gos, m\u00e1r csak azt kell kider\u00edteni, hova \u00e9s mennyit kell \u00e1sni.
\nN\u00e9h\u00e1ny perc besz\u00e9lget\u00e9s a J\u00f3s\u00e1g Corpor\u00e1ci\u00f3val \u2014 \u00e9s minden a hely\u00e9re ker\u00fcl. A tartalom sz\u00e1ll\u00edt\u00e1s\u00e1nak jav\u00edt\u00e1sa \u00e9rdek\u00e9ben a c\u00e9g Google <\/b>m\u00e9g 2012-ben bejelentette a protokollt QUIC<\/b>, amely lehet\u0151v\u00e9 teszi a TCP sz\u00e1mos h\u00e1tr\u00e1ny\u00e1nak elt\u00e1vol\u00edt\u00e1s\u00e1t (igen-igen-igen, ezekben a cikkekben \u2014 Friss<\/a><\/noindex><\/b> \u00e9s Kett\u0151<\/a><\/noindex><\/b> teljesen forradalmi megk\u00f6zel\u00edt\u00e9sr\u0151l van sz\u00f3, de legy\u00fcnk \u0151szint\u00e9k, ink\u00e1bb azt szeretn\u00e9m, hogy a cuki macsk\u00e1s k\u00e9pek gyorsabban bet\u00f6lt\u0151djenek, ne pedig ezek a tudatforradalmi \u00e9s fejl\u0151d\u00e9si diskurzusok). A tov\u00e1bbi kutat\u00e1sok sor\u00e1n kider\u00fclt, hogy sok szervezet most \u00e1tt\u00e9r az ilyen t\u00edpus\u00fa tartalom sz\u00e1ll\u00edt\u00e1s\u00e1ra.
\nA probl\u00e9m\u00e1m, \u00e9s gondolom, nem csak az \u00e9n esetemben, az volt, hogy v\u00e9g\u00fcl nagyon sok csomag \u00e9rkezik, \u00e9s a t\u0171zfal ezt \u00e1rv\u00edzk\u00e9nt \u00e9szlelte.
\nKis megold\u00e1si lehet\u0151s\u00e9g maradt:
\n1. Hozz\u00e1adni a t\u0171zfal DoS Policy<\/b> kiv\u00e9telek list\u00e1j\u00e1hoz a c\u00edmek tartom\u00e1ny\u00e1hoz Google<\/b>. Csak a lehets\u00e9ges c\u00edmek tartom\u00e1ny\u00e1nak gondolat\u00e1t\u00f3l a szemem idegesen kezdett r\u00e1ngani \u2014 elvetettem az \u00f6tletet, mint abszurdot.
\n2. Megemelni a triggereket a udp flood policy<\/b> sz\u00e1m\u00e1ra \u2014 ez sem megfelel\u0151, mi van, ha val\u00f3ban t\u00e1mad\u00f3 elcs\u00faszik.
\n3. Megtiltani a bels\u0151 h\u00e1l\u00f3zati kommunik\u00e1ci\u00f3t a UDP <\/b>Gyorsan eml\u00e9kezz\u00fcnk vissza, hogyan m\u0171k\u00f6dik a modul\u00e1ris aritmetika. Az \u00f3ra m\u00e1r egy ismert koncepci\u00f3. Az \u00f3r\u00e1k haszn\u00e1lata 443 <\/b>k\u00fcls\u0151 portokra.
\nTov\u00e1bbi inform\u00e1ci\u00f3kat olvasva a megval\u00f3s\u00edt\u00e1sr\u00f3l \u00e9s integr\u00e1ci\u00f3r\u00f3l, QUIC <\/b>be. a Google Chrome<\/b> utols\u00f3 lehet\u0151s\u00e9gk\u00e9nt l\u00e9pett akci\u00f3ba. Az a helyzet, hogy a mindenkori, mindenhol n\u00e9pszer\u0171 \u00e9s k\u00f6ny\u00f6rtelen\u00fcl (nem \u00e9rtem, mi\u00e9rt, ink\u00e1bb a pof\u00e1tlan v\u00f6r\u00f6s Firefox<\/b>-f\u00e9l\u00e9k kapj\u00e1k a megszegett gigab\u00e1jtok \u00e1r\u00e1t) a Google Chrome<\/b> kezdetben megpr\u00f3b\u00e1lja a szeretett \u00e9s megk\u00fczd\u00f6tt QUIC<\/b>kapcsolatot l\u00e9trehozni, de ha a csoda nem t\u00f6rt\u00e9nik meg, visszat\u00e9r a kipr\u00f3b\u00e1lt m\u00f3dszerekhez, mint p\u00e9ld\u00e1ul TLS<\/b>, b\u00e1r rettenetesen sz\u00e9gyelli ezt. <\/p>\n

A t\u0171zfalon l\u00e9trehozunk egy bejegyz\u00e9st a szolg\u00e1ltat\u00e1s sz\u00e1m\u00e1ra QUIC<\/b>:<\/p>\n

\"UDP
\n
\n\u00daj szab\u00e1lyt \u00e1ll\u00edtunk be, \u00e9s elhelyezz\u00fck egy kicsit magasabbra a l\u00e1ncban.<\/p>\n

\"UDP
\n
\nA szab\u00e1ly aktiv\u00e1l\u00e1sa ut\u00e1n az anom\u00e1li\u00e1k list\u00e1j\u00e1ban csend \u00e9s nyugalom lett, kiv\u00e9ve a val\u00f3ban gonosz szab\u00e1lys\u00e9rt\u0151ket.<\/p>\n

\"UDP
\n
\nK\u00f6sz\u00f6n\u00f6m mindenkinek a figyelmet.<\/p>\n

Felhaszn\u00e1lt forr\u00e1sok:<\/b><\/u>
\n1.Alekszandr Toboja jelent\u00e9se<\/a><\/noindex>
\n2.A QUIC protokoll le\u00edr\u00e1sa az Infopulse-t\u00f3l<\/a><\/noindex>
\n3.Wikipedia<\/a><\/noindex>
\n4. Fortinet KB<\/a><\/noindex>
\n
Forr\u00e1s: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood a Google-t\u00f3l vagy hogyan ne fosszuk meg az \u00f6sszes YouTube-ot | ProHoster","description":"Egy sz\u00e9p tavaszi est\u00e9n, amikor nem akartam hazamenni, \u00e9s az \u00e9lni \u00e9s megismerni val\u00f3 szenved\u00e9lyem \u00e9getett \u00e9s szor\u00edtott, felmer\u00fclt az \u00f6tlet, hogy belemer\u00fcljek a t\u0171zfalon egy vonz\u00f3 \u00faj funkci\u00f3ba, amelyet.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}