{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood fr\u00e5n Google eller hur man inte ber\u00f6var alla Youtube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En vacker v\u00e5rkv\u00e4ll, n\u00e4r jag inte ville g\u00e5 hem, och en oemotst\u00e5ndlig lust att leva och uppt\u00e4cka brann och skavde som gl\u00f6dande j\u00e4rn, f\u00f6ddes id\u00e9n att pilla med den lockande funktionen p\u00e5 brandv\u00e4ggen kallad «IP DOS-policy<\/b>«.
\nEfter f\u00f6rberedande smekningar och bekantskap med manualen st\u00e4llde jag in i l\u00e4ge Pass-and-Log<\/b>, f\u00f6r att se \u00f6verhuvudtaget vad som gick ut och den tveksamma nyttan av denna inst\u00e4llning.
\nEfter n\u00e5gra dagar (f\u00f6r att statistiken skulle ha samlats, f\u00f6rst\u00e5s, inte f\u00f6r att jag gl\u00f6mde) kikade jag i loggarna och b\u00f6rjade klappa h\u00e4nderna av gl\u00e4dje \u2014 det hade samlats s\u00e5 m\u00e5nga poster som man kan t\u00e4nka sig. Tycktes enkelt \u2014 aktivera policyn i l\u00e4ge att blockera alla som fl\u00f6dar, skannar, skapar half-open<\/b> sessioner med en timmes avst\u00e4ngning och sova lugnt med vetskapen om att gr\u00e4nsen \u00e4r l\u00e5st. Men det 34:e \u00e5ret av livet har \u00f6vervunnit ungdomlig maximalism och n\u00e5gonstans p\u00e5 bakhuvudet h\u00f6rdes en tunn r\u00f6st: \u00abL\u00e5t oss lyfta p\u00e5 \u00f6gonlocken och se, vems adresser v\u00e5r \u00e4lskade brandv\u00e4gg har identifierat som illvilliga fl\u00f6dlare? Jaha, i ordning av galenskap.\u00bb
\n<\/a><\/noindex>
\nVi b\u00f6rjar analysera de erh\u00e5llna data med listan \u00f6ver anomalier. Jag k\u00f6r adresserna genom ett enkelt skript Powershell<\/b> och \u00f6gonen snubblar \u00f6ver bekanta bokst\u00e4ver google<\/b>. <\/p>\n

\"UDP
\n
\nGnid i \u00f6gonen, blinkar i fem minuter f\u00f6r att s\u00e4kerst\u00e4lla att jag inte inbillade mig \u2014 verkligen p\u00e5 listan \u00f6ver dem som brandv\u00e4ggen ans\u00e5g vara illvilliga fl\u00f6dlare, typ av attack \u2014 udp flood<\/b>, adresser som tillh\u00f6r den goda f\u00f6retaget. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\nJag kliar mig i nacken, samtidigt som jag st\u00e4ller in paketupptagningen p\u00e5 det externa gr\u00e4nssnittet f\u00f6r senare analys. I huvudet sveper regnb\u00e5gsf\u00e4rgade tankar: \"Hur kan n\u00e5got infekterat finnas inom Google-sf\u00e4ren? Och det var jag som uppt\u00e4ckte det? Det h\u00e4r inneb\u00e4r bel\u00f6ningar, hedersbetygelser och den r\u00f6da mattan, samt mitt eget kasino med blackjack och, ja, ni f\u00f6rst\u00e5r…\"<\/p>\n

Jag analyserar den erh\u00e5llna filen Wireshark<\/b>-om.
\nJa, det \u00e4r verkligen fr\u00e5n en adress inom r\u00e4ckvidden Google <\/b>fritsar UDP-paket fr\u00e5n port 443 till en slumpm\u00e4ssig port p\u00e5 min enhet.
\nMen, v\u00e4nta nu\u2026 H\u00e4r byts protokoll fr\u00e5n UDP<\/b> till GQUIC<\/b>.
\nSemen Semenovich\u2026<\/p>\n

\"UDP
\n
\nJag kommer genast ih\u00e5g rapporten fr\u00e5n HighLoad <\/b>Alexander Tobolja<\/u> \u00abUDP<\/b> mot TCP<\/b> eller framtiden f\u00f6r n\u00e4tverksstacken»(link<\/a><\/noindex>).
\n\u00c5 ena sidan, kommer en l\u00e4tt besvikelse \u2014 ingen \u00e4ra, inga hedersutm\u00e4rkelser. \u00c5 andra sidan, problemet \u00e4r klart; det \u00e5terst\u00e5r att f\u00f6rst\u00e5 vart och hur mycket vi ska gr\u00e4va.
\nEtt par minuters samtal med Godhetens Korporetion \u2013 och allt faller p\u00e5 plats. F\u00f6r att f\u00f6rb\u00e4ttra leveranshastigheten av inneh\u00e5ll tillk\u00e4nnagav f\u00f6retaget Google <\/b>redan 2012 protokollet QUIC<\/b>, som tar bort den st\u00f6rsta delen av TCP:s nackdelar (ja, ja, ja, i dessa artiklar \u2013 Rrrazz<\/a><\/noindex><\/b> och Tv\u00e5<\/a><\/noindex><\/b> det talas om en helt revolutionerande metod, men l\u00e5t oss vara \u00e4rliga, man vill att kattbilder ska laddas snabbare, inte de h\u00e4r alla era medvetanderevolutioner och framsteg). Som vidare forskning har visat, g\u00e5r m\u00e5nga organisationer nu \u00f6ver till denna typ av inneh\u00e5llsleverans.
\nProblemet i mitt och, jag tror, inte bara i mitt fall var att det kom s\u00e5 m\u00e5nga paket att brandv\u00e4ggen uppfattade dem som flod.
\nDet fanns inte m\u00e5nga l\u00f6sningar:
\n1. L\u00e4gga till i undantagslistan f\u00f6r DoS Policy<\/b> p\u00e5 brandv\u00e4ggen med adressomr\u00e5det Google<\/b>. Med bara tanken p\u00e5 intervallet av m\u00f6jliga adresser b\u00f6rjade \u00f6gonen nerv\u00f6st fladdra \u2013 id\u00e9n sk\u00f6ts upp som galen.
\n2. H\u00f6ja utl\u00f6sningstr\u00f6skeln f\u00f6r udp flood policy<\/b> \u2013 inte heller bra, vad h\u00e4nder om n\u00e5gon verkligt illvillig smyger sig f\u00f6rbi.
\n3. F\u00f6rbjuda anrop fr\u00e5n det interna n\u00e4tverket till UDP <\/b>till 443 <\/b>porten ut.
\nEfter att ha l\u00e4st mer om implementeringen och integreringen QUIC <\/b>p\u00e5 Google Chrome<\/b> antogs som \u00e5tg\u00e4rd den sista varianten. Grejen \u00e4r att den av alla \u00e4lskade och h\u00e4nsynsl\u00f6sa (kan inte f\u00f6rst\u00e5 varf\u00f6r, hellre hade jag sett den skaml\u00f6sa r\u00f6dh\u00e5riga Firefox<\/b>-ska ansiktet f\u00e5 betala f\u00f6r de upp\u00e4tna gigabyterna rambuffert), Google Chrome<\/b> f\u00f6rs\u00f6ker f\u00f6rst uppr\u00e4tta en anslutning med sin pl\u00e5gade QUIC<\/b>, men om miraklet inte intr\u00e4ffar, s\u00e5 \u00e5terv\u00e4nder han till bepr\u00f6vade metoder som TLS<\/b>, \u00e4ven om han sk\u00e4ms enormt \u00f6ver det. <\/p>\n

Vi skapar en post p\u00e5 brandv\u00e4ggen f\u00f6r tj\u00e4nsten QUIC<\/b>:<\/p>\n

\"UDP
\n
\nVi st\u00e4ller in en ny regel och placerar den n\u00e5gonstans h\u00f6gre upp i kedjan.<\/p>\n

\"UDP
\n
\nEfter att regeln aktiverats \u00e4r det tyst och lugnt i anomalilistan, f\u00f6rutom de verkligt illvilliga \u00f6vertr\u00e4darna.<\/p>\n

\"UDP
\n
\nTack f\u00f6r er uppm\u00e4rksamhet.<\/p>\n

Anv\u00e4nda resurser:<\/b><\/u>
\n1.Alexander Todyla rapport<\/a><\/noindex>
\n2.Beskrivning av QUIC-protokollet fr\u00e5n Infopulse<\/a><\/noindex>
\n3.Wikipedia<\/a><\/noindex>
\n4. KB fr\u00e5n Fortinet<\/a><\/noindex>
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood fr\u00e5n Google eller hur man inte ber\u00f6var alla Youtube | ProHoster","description":"En underbar v\u00e5rkv\u00e4ll, n\u00e4r det inte fanns n\u00e5gon lust att g\u00e5 hem, och den ohejdade livslusten och nyfikenheten kliade och br\u00e4nde som ett gl\u00f6dande j\u00e4rn, f\u00f6ddes id\u00e9n att pilla p\u00e5 den lockande funktionen p\u00e5 brandv\u00e4ggen som kallas.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}