{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood od Google czyli jak nie pozbawi\u0107 wszystkich YouTube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «polityka DOS IP<\/b>«.
\nPo wst\u0119pnym zapoznaniu si\u0119 z instrukcj\u0105 ustawi\u0142em w trybie Pass-and-Log<\/b>, aby zobaczy\u0107, co w\u0142a\u015bciwie si\u0119 wydarzy i jak\u0105 w\u0105tpliw\u0105 u\u017cyteczno\u015b\u0107 ma to ustawienie.
\nPo kilku dniach (\u017ceby statystyki si\u0119 zgromadzi\u0142y, oczywi\u015bcie, a nie dlatego, \u017ce zapomnia\u0142em) spojrza\u0142em do log\u00f3w i, ta\u0144cz\u0105c w miejscu, zaklaska\u0142em w d\u0142onie \u2013 zebra\u0142o si\u0119 tyle wpis\u00f3w, \u017ce mo\u017cna by je sprzeda\u0107. Wydawa\u0142oby si\u0119, \u017ce to proste \u2013 w\u0142\u0105cz polityk\u0119 w trybie blokowania wszystkich flooduj\u0105cych, skanuj\u0105cych, ustalaj\u0105cych half-open<\/b> sesje z banem na godzin\u0119 i \u015bpij spokojnie, maj\u0105c \u015bwiadomo\u015b\u0107, \u017ce granica jest zamkni\u0119ta. Ale 34. rok \u017cycia przekroczy\u0142 m\u0142odzie\u0144czy maksymalizm i gdzie\u015b w zakamarkach m\u00f3zgu rozleg\u0142 si\u0119 cienki g\u0142osik: \u201eA mo\u017ce zajrzyjmy, a czyje to adresy nasz ukochany firewall rozpozna\u0142 jako notorycznych floodowc\u00f3w? Tak, dla jaj.\u201d
\n<\/a><\/noindex>
\nZaczynam analizowa\u0107 zdobyte dane z listy anomalii. Przeprowadzam adresy przez prosty skrypt Powershell<\/b> i moje oczy natrafiaj\u0105 na znajome litery google<\/b>. <\/p>\n

\"UDP
\n
\nTr\u0119 oczy, mrugam przez pi\u0119\u0107 minut, aby upewni\u0107 si\u0119, \u017ce si\u0119 nie myl\u0119 \u2014 naprawd\u0119 na li\u015bcie tych, kt\u00f3rych firewall uzna\u0142 za notorycznych floodowc\u00f3w, typ ataku \u2013 udp flood<\/b>, adresy, kt\u00f3re nale\u017c\u0105 do korporacji dobra. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\n\u0427\u0435\u0448\u0443 \u0432 \u0437\u0430\u0442\u044b\u043b\u043a\u0435, \u043f\u043e\u043f\u0443\u0442\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0437\u0430\u0445\u0432\u0430\u0442 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430. \u0412 \u0433\u043e\u043b\u043e\u0432\u0435 \u043f\u0440\u043e\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0440\u0430\u0434\u0443\u0436\u043d\u044b\u0435 \u043c\u044b\u0441\u043b\u0438: \u00ab\u041a\u0430\u043a \u0442\u0430\u043a, \u0447\u0442\u043e-\u0442\u043e \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0432 \u0441\u043a\u043e\u0443\u043f\u0435 Google? \u0418 \u044d\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u044f? \u0414\u0430 \u044d\u0442\u043e \u0436, \u044d\u0442\u043e \u0436 \u2014 \u043d\u0430\u0433\u0440\u0430\u0434\u044b, \u043f\u043e\u0447\u0435\u0441\u0442\u0438 \u0438 \u043a\u0440\u0430\u0441\u043d\u0430\u044f \u043a\u043e\u0432\u0440\u043e\u0432\u0430\u044f \u0434\u043e\u0440\u043e\u0436\u043a\u0430, \u0438 \u0441\u0432\u043e\u0435 \u043a\u0430\u0437\u0438\u043d\u043e \u0441 \u0431\u043b\u0435\u043a\u0434\u0436\u0435\u043a\u043e\u043c \u0438, \u043d\u0443 \u0432\u044b \u043f\u043e\u043d\u044f\u043b\u0438…\u00bb<\/p>\n

Analizuj\u0119 otrzymany plik Wireshark<\/b>-owego.
\nTak, rzeczywi\u015bcie, z adresu w zasi\u0119gu Google <\/b>przesy\u0142ane s\u0105 pakiety UDP z portu 443 na losowy port na moim urz\u0105dzeniu.
\nAle, poczekajcie\u2026 Oto protok\u00f3\u0142 zmienia si\u0119 z UDP<\/b> na GQUIC<\/b>.
\nSemenie Semenowiczu\u2026<\/p>\n

\"UDP
\n
\nOd razu przypomnia\u0142em sobie wyk\u0142ad z HighLoad <\/b>Aleksandra Tobola<\/u> «UDP<\/b> przeciwko TCP<\/b> \u0438\u043b\u0438 \u0431\u0443\u0434\u0443\u0449\u0435\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430»(link<\/a><\/noindex>).
\nZ jednej strony narasta lekkie rozczarowanie \u2014 ani powa\u017canych nagr\u00f3d, ani zaszczyt\u00f3w. Z drugiej strony, problem jest jasny, pozostaje tylko zrozumie\u0107, gdzie i ile kopa\u0107.
\nKilka minut rozmowy z Korporacj\u0105 Dobra \u2014 i wszystko wraca na swoje miejsce. W d\u0105\u017ceniu do poprawy szybko\u015bci dostarczania tre\u015bci firma Google <\/b>ju\u017c w 2012 roku og\u0142osi\u0142a protok\u00f3\u0142 QUIC<\/b>, kt\u00f3ry ma na celu usuni\u0119cie wi\u0119kszo\u015bci wad TCP (tak, tak, w tych artyku\u0142ach \u2014 Raz<\/a><\/noindex><\/b> i Dwa<\/a><\/noindex><\/b> m\u00f3wi si\u0119 o zupe\u0142nie rewolucyjnym podej\u015bciu, ale b\u0105d\u017amy szczerzy, chcemy, aby zdj\u0119cia kot\u00f3w \u0142adowa\u0142y si\u0119 szybciej, a nie ca\u0142e wasze rewolucje w \u015bwiadomo\u015bci i post\u0119pie). Jak pokaza\u0142y dalsze badania, wiele organizacji przechodzi obecnie na ten spos\u00f3b dostarczania tre\u015bci.
\nProblem w moim, a my\u015bl\u0119, \u017ce nie tylko w moim przypadku, okaza\u0142 si\u0119 taki, \u017ce ko\u0144cowo pakiet\u00f3w jest zdecydowanie za du\u017co i zapora sieciowa postrzega je jako flood.
\nRozwi\u0105za\u0144 okaza\u0142o si\u0119 niewiele:
\n1. Doda\u0107 do listy wyj\u0105tk\u00f3w dla Polityki DoS<\/b> na zaporze zakres adres\u00f3w Google<\/b>. Przy samej my\u015bli o zakresie mo\u017cliwych adres\u00f3w oko zacz\u0119\u0142o nerwowo drga\u0107 \u2014 pomys\u0142 od\u0142o\u017cony jako absurdalny.
\n2. Podnie\u015b\u0107 pr\u00f3g uruchamiania dla polityki flood UDP<\/b> \u2014 te\u017c nie jest idealnie, a co je\u015bli kto\u015b naprawd\u0119 z\u0142o\u015bliwy si\u0119 wymknie.
\n3. Zakaza\u0107 dost\u0119pu z wewn\u0119trznej sieci przez UDP <\/b>na 443 <\/b>port na zewn\u0105trz.
\nPo przeczytaniu dodatkowych informacji na temat realizacji i integracji QUIC <\/b>do Google Chrome<\/b> ostatnia opcja zosta\u0142a przyj\u0119ta jako wskaz\u00f3wka do dzia\u0142ania. Sytuacja jest taka, \u017ce, powszechnie lubiany i bezwzgl\u0119dny (nie rozumiem, za co, lepiej, aby nachalna, ruda Firefox<\/b>-owska g\u0119ba dostawa\u0142a za zjedzone gigabajty pami\u0119ci operacyjnej), Google Chrome<\/b> pocz\u0105tkowo pr\u00f3buje nawi\u0105za\u0107 po\u0142\u0105czenie z u\u017cyciem swojego wytrwa\u0142ego QUIC<\/b>, ale je\u015bli nie odniesie sukcesu, wraca do sprawdzonych metod, takich jak TLS<\/b>, chocia\u017c straszliwie si\u0119 tego wstydzi. <\/p>\n

Tworzymy w zaporze wpis dla us\u0142ugi QUIC<\/b>:<\/p>\n

\"UDP
\n
\nKonfigurujemy now\u0105 regu\u0142\u0119 i umieszczamy j\u0105 gdzie\u015b wy\u017cej w \u0142a\u0144cuchu.<\/p>\n

\"UDP
\n
\nPo w\u0142\u0105czeniu regu\u0142y w li\u015bcie anomalii cisza, poza naprawd\u0119 z\u0142o\u015bliwymi naruszycielami.<\/p>\n

\"UDP
\n
\nDzi\u0119kuj\u0119 wszystkim za uwag\u0119.<\/p>\n

Wykorzystane zasoby:<\/b><\/u>
\n1.Raport Aleksandra Tobola<\/a><\/noindex>
\n2.Opis protoko\u0142u QUIC od firmy Infopulse<\/a><\/noindex>
\n3.Wikipedia<\/a><\/noindex>
\n4. KB od Fortinet<\/a><\/noindex>
\n
\u0179r\u00f3d\u0142o: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood od Google, czyli jak nie pozbawi\u0107 wszystkich YouTube | ProHoster","description":"Pewnego pi\u0119knego, wiosennego wieczoru, kiedy nie chcia\u0142o si\u0119 wraca\u0107 do domu, a nieposkromna ch\u0119\u0107 \u017cycia i poznawania sw\u0119dzi\u0142a i pali\u0142a jak rozgrzane \u017celazo, pojawi\u0142 si\u0119 pomys\u0142, aby pogrzeba\u0107 w atrakcyjnej nowince funkcji w zaporze nazwanej.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}