{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood od Google ili kako ne li\u0161iti sve Youtube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS politika<\/b>«.
\nPosle preliminarnih koraka i upoznavanja sa uputstvom, postavio sam re\u017eim Pass-and-Log<\/b>, da bih video kakav je ukupni ishod i sumnjivu korisnost ove postavke.
\nNakon nekoliko dana (da se statistika prikupi, naravno, a ne zato \u0161to sam zaboravio), pogledao sam u logove i aplaudirao od radosti \u2014 zabele\u017eenih podataka je bilo u izobilju. Delovalo bi da je to jednostavno \u2014 uklju\u010di politiku za blokiranje svih koji \u0161alju spam, skeniraju ili uspostavljaju half-open<\/b> sesije sa zabranom na sat vremena i mirno spavaj uz saznanje da je granica zaklju\u010dana. No, 34. godina \u017eivota donela je prevazila\u017eenje mladala\u010dkog maksimalizma i negde u pozadini mog mozga za\u010duo se tihi glas: \u201eA hajde da otvorimo o\u010di i pogledamo \u010dija su to adrese na\u0161 omiljeni vatrozid prepoznao kao zloslutne spamere? Ba\u0161, da probamo.\u201d
\n<\/a><\/noindex>
\nPo\u010dinjemo analizirati dobijene podatke sa liste anomalija. Propu\u0161tam adrese kroz jednostavan skript Powershell<\/b> i o\u010di mi zapnu za poznate karaktere google<\/b>. <\/p>\n

\"UDP
\n
\nTrinam o\u010di, trep\u0107u\u0107i pet minuta da se uverim da mi se nije u\u010dinilo \u2014 zaista u listi onih koje je vatrozid smatrao zloslutnim spammerima, tip napada \u2014 udp flood<\/b>, adrese koje pripadaju korporaciji dobra. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\n\u0427\u0435\u0448\u0443 \u0432 \u0437\u0430\u0442\u044b\u043b\u043a\u0435, \u043f\u043e\u043f\u0443\u0442\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0437\u0430\u0445\u0432\u0430\u0442 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430. \u0412 \u0433\u043e\u043b\u043e\u0432\u0435 \u043f\u0440\u043e\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0440\u0430\u0434\u0443\u0436\u043d\u044b\u0435 \u043c\u044b\u0441\u043b\u0438: \u00ab\u041a\u0430\u043a \u0442\u0430\u043a, \u0447\u0442\u043e-\u0442\u043e \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0432 \u0441\u043a\u043e\u0443\u043f\u0435 Google? \u0418 \u044d\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u044f? \u0414\u0430 \u044d\u0442\u043e \u0436, \u044d\u0442\u043e \u0436 \u2014 \u043d\u0430\u0433\u0440\u0430\u0434\u044b, \u043f\u043e\u0447\u0435\u0441\u0442\u0438 \u0438 \u043a\u0440\u0430\u0441\u043d\u0430\u044f \u043a\u043e\u0432\u0440\u043e\u0432\u0430\u044f \u0434\u043e\u0440\u043e\u0436\u043a\u0430, \u0438 \u0441\u0432\u043e\u0435 \u043a\u0430\u0437\u0438\u043d\u043e \u0441 \u0431\u043b\u0435\u043a\u0434\u0436\u0435\u043a\u043e\u043c \u0438, \u043d\u0443 \u0432\u044b \u043f\u043e\u043d\u044f\u043b\u0438…\u00bb<\/p>\n

Razmatram dobijeni fajl Wireshark<\/b>-om.
\nDa, zaista sa adrese iz domena Google <\/b>prilaze paketi UDP sa 443 porta na nasumi\u010dni port na mom ure\u0111aju.
\nAli, sa\u010dekajte\u2026 Eto protokol se menja sa UDP<\/b> na GQUIC<\/b>.
\nSemjon Semjovi\u010d\u2026<\/p>\n

\"UDP
\n
\nOdmah se setim izlaganja sa HighLoad <\/b>Aleksandra Tobolja<\/u> «UDP<\/b> protiv TCP<\/b> \u0438\u043b\u0438 \u0431\u0443\u0434\u0443\u0449\u0435\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430»(link<\/a><\/noindex>).
\nS jedne strane, nastaje blago razo\u010daranje \u2014 ni laureata, ni po\u010dasti. S druge strane, problem je jasan, ostaje da se razjasni gde i koliko kopati.
\nPar minutah pogovora s Korporacijo Dobra \u2014 in vse se postavi na svoje mesto. V poskusu izbolj\u0161anja hitrosti dostave vsebine je podjetje Google <\/b>\u017ee leta 2012 napovedalo protokol QUIC<\/b>, ki omogo\u010da odpravo ve\u010dine pomanjkljivosti TCP (da-da-da, v teh \u010dlankih \u2014 Prrraz<\/a><\/noindex><\/b> in Dva<\/a><\/noindex><\/b> govori o povsem revolucionarnem pristopu, vendar bodimo iskreni, \u017eelimo, da se slike ma\u010dk nalagajo hitreje, namesto vseh teh revolucionarnih misli in napredka). Kot je pokazala nadaljnja raziskava, mnoge organizacije trenutno prehajajo na tovrstno dostavo vsebine.
\nTe\u017eava v mojem in, mislim, ne samo v mojem primeru se je izkazala za to, da paketov na koncu gre res veliko in po\u017earni zid jih zaznava kot poplavo.
\nMo\u017enosti re\u0161itve se je izkazalo malo:
\n1. Dodati v seznam izjem za DoS Policy<\/b> na po\u017earnem zidu obseg naslovov Google<\/b>. Pri sami misli o obsegu mo\u017enih naslovov je oko za\u010delo \u017eiv\u010dno trzati \u2014 ideja je bila zavr\u017eena kot neupravi\u010dena.
\n2. Povi\u0161ati prag spro\u017eitve za udp flood policy<\/b> \u2014 tudi ni optimalno, da ne bi kdo resni\u010dno maliciozno pri\u0161el mimo.
\n3. Prepovedati klice iz notranje mre\u017ee po UDP <\/b>na 443 <\/b>pristani\u0161\u010du navzven.
\nPotem ko sem dodatno prebral o implementaciji in integraciji QUIC <\/b>u Google Chrome<\/b> je bil sprejet kot ukaz za dejanje zadnji variant. Gre namre\u010d za to, da Firefox<\/b>-ovska maskota sprva posku\u0161a vzpostaviti povezavo z uporabo svoje izku\u0161enj Google Chrome<\/b> , \u010de pa \u010dude\u017e ne uspe, se vrne k preverjenim metodam, kot so QUIC<\/b>TLS , \u010deprav se tega zelo sramuje.<\/b>Ustvarimo na po\u017earnem zidu vnos za storitev <\/p>\n

Nastavimo novo pravilo in ga postavimo nekje vi\u0161je v verigi. QUIC<\/b>:<\/p>\n

\"UDP
\n
\nPo vklopu pravila je v seznamu anomalij mir in ti\u0161ina, razen pri res grdeh kr\u0161iteljih.<\/p>\n

\"UDP
\n
\nHvala vsem za pozornost.<\/p>\n

\"UDP
\n
\nUporabljeni viri:<\/p>\n

Poro\u010dilo Aleksandra Tobolja<\/b><\/u>
\n1.Opis protokola QUIC podjetja Infopuls<\/a><\/noindex>
\n2.Wikipedia<\/a><\/noindex>
\n3.KB podjetja Fortinet<\/a><\/noindex>
\n4. Performance v .NET Core<\/a><\/noindex>
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood od Google ili kako ne uskratiti sve Youtube | ProHoster","description":"Nekega \u010dudovitega pomladnega ve\u010dera, ko se ni dalo iti domov, a nenehna \u017eelja po \u017eivljenju in spoznavanju je srbenje in \u017egala kot razbeljeno \u017eelezo, se je rodila ideja, da se griznem v mamljivo funkcijo na po\u017earnem zidu, imenovano.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}