{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood de la Google sau cum s\u0103 nu privezi pe toat\u0103 lumea de Youtube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00centr-o sear\u0103 frumoas\u0103 de prim\u0103var\u0103, c\u00e2nd nu aveam chef s\u0103 merg acas\u0103, iar dorin\u021ba nest\u0103vilit\u0103 de a tr\u0103i \u0219i de a descoperi m\u0103 fr\u0103m\u00e2nta ca un fier \u00eencins, m-a lovit ideea s\u0103 \u00eencep s\u0103 experimentez o func\u021bie tentant\u0103 pe firewall numit\u0103 «politica IP DOS<\/b>«.
\nDup\u0103 c\u00e2teva preg\u0103tiri \u0219i familiarizarea cu manualul, am configurat \u00een modul Pass-and-Log<\/b>, pentru a verifica ce ie\u0219ire am \u0219i c\u00e2t de util\u0103 este aceast\u0103 configurare.
\nDup\u0103 c\u00e2teva zile (pentru a aduna statistici, desigur, nu pentru c\u0103 am uitat), m-am uitat \u00een log-uri \u0219i, dans\u00e2nd pe loc, am aplaudat \u2014 am adunat at\u00e2tea \u00eenregistr\u0103ri \u00eenc\u00e2t dep\u0103\u0219e\u0219te cele mai mari a\u0219tept\u0103ri. Ar p\u0103rea c\u0103 e simplu \u2014 activeaz\u0103 politica \u00een modul de blocare a tuturor flooding-urilor, scan\u0103rilor, care stabilesc half-open<\/b> sesiuni cu o interdic\u021bie de o or\u0103 \u0219i dormi lini\u0219tit \u0219tiind c\u0103 frontiera este asigurat\u0103. Dar, \u00een al 34-lea an de via\u021b\u0103, am dep\u0103\u0219it maximul juvenil \u0219i undeva \u00een creier a r\u0103sunat o voce sub\u021bire: \u201eHai s\u0103 ridic\u0103m pleoapele \u0219i s\u0103 vedem, care adrese a recunoscut firewall-ul nostru drag ca fiind flooderi r\u0103u inten\u021biona\u021bi? A\u0219a, de bun\u0103 voie.\u201d
\n<\/a><\/noindex>
\n\u00cencepem s\u0103 analiz\u0103m datele ob\u021binute din lista anomaliilor. R\u0103spund adresele printr-un script simplu Powershell<\/b> \u0219i privirea \u00eemi cade pe literele cunoscute google<\/b>. <\/p>\n

\"UDP
\n
\nM\u0103 frec la ochi, clipez timp de cinci minute pentru a m\u0103 asigura c\u0103 nu este o iluzie \u2014 \u00eentr-adev\u0103r, \u00een lista celor pe care firewall-ul i-a considerat flooderi r\u0103u inten\u021biona\u021bi, tipul de atac este udp flood<\/b>, adrese ce apar\u021bin corpora\u021biei binelui. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\nM\u0103 g\u00e2ndesc la toate astea, \u00een timp ce configurez capturarea pachetelor pe interfa\u021ba extern\u0103 pentru analiza ulterioar\u0103. \u00cen minte \u00eemi trec g\u00e2nduri colorate: \u201eCum e posibil ca ceva infectat s\u0103 fie \u00een domeniul Google? \u0218i eu am descoperit asta? E ca \u0219i cum, a\u0219 primi premii, onoruri, un covor ro\u0219u \u0219i un cazino cu blackjack \u0219i, ei bine, a\u021bi \u00een\u021beles…\u201d<\/p>\n

Analizez fi\u0219ierul ob\u021binut Wireshark<\/b>-om.
\nDa, cu adev\u0103rat dintr-o adres\u0103 din sfera Google <\/b>vin pachete UDP de pe portul 443 pe un port aleator pe dispozitivul meu.
\nDar, a\u0219teapt\u0103\u2026 Protocul se schimb\u0103 de la UDP<\/b> pe GQUIC<\/b>.
\nSemyon Semyonovich\u2026<\/p>\n

\"UDP
\n
\n\u00cemi amintesc imediat de raportul lui HighLoad <\/b>Alexandr Tobol<\/u> \u00abUDP<\/b> \u00eempotriva TCP<\/b> sau viitorul stivei de re\u021bea»(link<\/a><\/noindex>).
\nPe de o parte, apare o u\u0219oar\u0103 dezam\u0103gire \u2014 nici premii, nici onoruri. Pe de alt\u0103 parte, problema este clar\u0103, r\u0103m\u00e2ne doar s\u0103 \u00een\u021belegem unde \u0219i c\u00e2t s\u0103 s\u0103p\u0103m.
\nC\u00e2teva minute de conversa\u021bie cu Corpora\u021bia Bun\u0103voin\u021bei \u2014 \u0219i totul \u00ee\u0219i revine \u00een matca sa. \u00cen \u00eencercarea de a \u00eembun\u0103t\u0103\u021bi viteza de livrare a con\u021binutului, compania Google <\/b>a anun\u021bat \u00een 2012 protocolul QUIC<\/b>, care permite eliminarea celor mai multe dintre dezavantajele TCP (da, da, da, \u00een aceste articole \u2014 Iat\u0103<\/a><\/noindex><\/b> \u0219i Dou\u0103<\/a><\/noindex><\/b> se vorbe\u0219te despre o abordare complet revolu\u021bionar\u0103, dar, s\u0103 fim sinceri, ne dorim cu adev\u0103rat ca pozele cu pisici s\u0103 se \u00eencarce mai repede, nu toate aceste revolu\u021bii ale con\u0219tiin\u021bei \u0219i progresele voastre). A\u0219a cum a ar\u0103tat o cercetare ulterioar\u0103, multe organiza\u021bii trec acum la o astfel de variant\u0103 de livrare a con\u021binutului.
\nProblema \u00een cazul meu, \u0219i cred c\u0103 nu doar al meu, a fost c\u0103 pachetele ajung \u00een num\u0103r foarte mare \u0219i firewall-ul le percepe ca pe un flood.
\nSolu\u021biile s-au dovedit a fi pu\u021bine:
\n1. Ad\u0103ugarea la lista de excep\u021bii pentru Politica DoS<\/b> de pe firewall pentru domeniul de adrese Google<\/b>. Doar g\u00e2ndul la gama de adrese posibile a \u00eenceput s\u0103-mi fac\u0103 ochii s\u0103 tremure \u2014 am abandonat ideea ca fiind absurd\u0103.
\n2. Cre\u0219terea pragului de activare pentru politica UDP flood<\/b> \u2014 de asemenea, nu e o solu\u021bie ideal\u0103, \u0219i dac\u0103 cumva cineva cu adev\u0103rat r\u0103u inten\u021bionat s-ar strecura.
\n3. Interzicerea accesului din re\u021beaua intern\u0103 pe UDP <\/b>pe 443 <\/b>porturile externe.
\nCitind suplimentar despre implementare \u0219i integrare QUIC <\/b>\u00een Google Chrome<\/b> s-a decis s\u0103 ac\u021bion\u0103m conform ultimei op\u021biuni. Este vorba despre faptul c\u0103, iubitul de to\u021bi \u0219i nemilos (nu \u00een\u021beleg de ce, mai bine o fa\u021b\u0103 obraznic\u0103 \u0219i ro\u0219cat\u0103 Firefox<\/b>-oferind un cap de pe o fa\u021b\u0103 obosit\u0103, va primi pentru gigabaitii de RAM folosi\u021bi), Google Chrome<\/b> \u00een mod ini\u021bial \u00eencearc\u0103 s\u0103 stabileasc\u0103 o conexiune folosind QUIC<\/b>, dar dac\u0103 nu se produce o minune, atunci revine la metodele testate, cum ar fi TLS<\/b>, de\u0219i \u00eei este foarte ru\u0219ine de asta. <\/p>\n

Cre\u0103m \u00een firewall o \u00eenregistrare pentru serviciu QUIC<\/b>:<\/p>\n

\"UDP
\n
\nConfigur\u0103m o nou\u0103 reglementare \u0219i o plas\u0103m undeva mai sus \u00een lan\u021b.<\/p>\n

\"UDP
\n
\nDup\u0103 activarea regulii, \u00een lista anomaliilor este lini\u0219te \u0219i pace, cu excep\u021bia infractorilor cu adev\u0103rat r\u0103u inten\u021biona\u021bi.<\/p>\n

\"UDP
\n
\nV\u0103 mul\u021bumesc tuturor pentru aten\u021bie.<\/p>\n

Resurse utilizate:<\/b><\/u>
\n1.Raportul lui Alexander Tobol<\/a><\/noindex>
\n2.Descrierea protocolului QUIC de la compania Infopulse<\/a><\/noindex>
\n3.Wikipedia<\/a><\/noindex>
\n4. KB de la Fortinet<\/a><\/noindex>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood de la Google sau cum s\u0103 nu le iei tuturor Youtube | ProHoster","description":"\u00centr-o frumoas\u0103 sear\u0103 de prim\u0103var\u0103, c\u00e2nd nu mi-a\u0219 fi dorit s\u0103 m\u0103 \u00eentorc acas\u0103, iar dorin\u021ba neostoit\u0103 de a tr\u0103i \u0219i a descoperi m\u0103 zg\u00e2nd\u0103rea \u0219i m\u0103 ardea ca fierul \u00eencins, a ap\u0103rut ideea de a explora o func\u021bie tentant\u0103 a firewall-ului numit\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}