2/8     After the recent attacks against the big boys of
        dot com how does a guy prevent further Denial of service (DoS)
        from happening to his own cos. - curious
        \_ You don't.  You can filter some of the crap but never be totally
           safe from it with current protocols and technology.
           \_ why not just change the filter properties?
                \_ Which devices do you own that can filter 1 gigabit per
                   second without crashing while still letting the good
                   traffic through?  And what if the DoS consists of properly
                   formed http calls?  What are you going to filter?
                   \_ so i guess you need to call an upstream isp to put
                      in the proper filters?
                        \_ Idiot!
                        \_ Argh!  TROLL!
                           \_ well, isn't that what they did to stop
                              the http://cnn.com attack?
                                \_ Yeah, they turned on the "filter_DoS_packets"
                                   rule in the routers.  Some new guy had
                                   turned it off and no one noticed.
                                   \_ so i guess you don't know then, huh?
                                        \_ I think when they upgraded to dos
                                           version 2.11, everything was ok.
             \_ what are you going to filter, when the DoS looks EXACTLY like
                lots of normal traffic packets?  Is the 'Slashdot Effect'
                a malicious attack, or just your site suddenly becoming very
                popular.  Either way, your site is basically down.
                \_ are you sure DoS packets look exactly like normal packets?
                        \_ Of course not.  They have the DoS flag set.
                           \_ so i guess you don't know then, huh?
                                \_ The dos upgrade to v2.11 fixed it.
        \_ A possibility would be to make your company site a moving target.
           Have sevearal locations/IP's you can use. When one IP gets hit with
           the big DoS, change your DNS entry ( you set your TTL low ahead
           of time, right?), and move your site to the new IP.
                \_ That'll work, uh... never.  DoS kiddies just get the new
                   IP the same as everyone else.  Welcome to the internet.
                        \_ ACK!  I've been trolled!
        \_ if you have to ask, you don't know
           \_ thanx for stating the obvious
        \_ Unplug net cable.
        \_ If companies with hundreds of millions of dollars at stake can't
           prevent it, what the hell makes you think you can?
                \_ Because I read a zdnet article about how to stop it.
                     \_ it's so ironic, that zdnet was attacked and shutdown
                        for 2 hours this morning.
        \_ Very little.  Try not to be a tempting target.  The way the big
           sites were attacked recently was by distributed clients running
           on many windows boxes infected with a remotely activated virus.
           There wasn't any obvious TCP stack bug problem with the servers
           or anything, they just got overwhelmed by tons of valid-looking
           hits.  Short of weird heuristics, there's very little you can
           do about this.
        \_ What about authenticated IP? -- network newbie
           \_ Won't stop traffic floods, which is what they're getting
              hit with.
           \_ First define authenticated IP, then figure out how much your
                business will lose by cutting off all the random web users
                who don't use it.
        \_ Why don't we all start attacking http://www.microsoft.com and bring down
           the Evil Empire(TM)?