1Demonstrations of dddos.py, the Linux eBPF/bcc version. 2 3This tracks ip_rcv function (using kprobe) and elapsed time 4between received packets to detect potential DDOS attacks. 5 6The following steps illustrates the usage of dddos : 71 - Start dddos.py : 8# ./dddos.py 9DDOS detector started ... Hit Ctrl-C to end! 10TIME(s) MESSAGE 11 122 - Launch hping3 (or any other flooder) in another terminal as shown below: 13# hping3 localhost -S -A -V -p 443 -i u100 14 153 - dddos.py triggers alerts and reports a DDOS attack: 16DDOS detector started ... Hit Ctrl-C to end! 17TIME(s) MESSAGE 182019-01-16 11:55:12.600734 DDOS Attack => nb of packets up to now : 1001 192019-01-16 11:55:12.600845 DDOS Attack => nb of packets up to now : 1002 202019-01-16 11:55:12.600887 DDOS Attack => nb of packets up to now : 1003 212019-01-16 11:55:12.600971 DDOS Attack => nb of packets up to now : 1004 222019-01-16 11:55:12.601009 DDOS Attack => nb of packets up to now : 1005 232019-01-16 11:55:12.601062 DDOS Attack => nb of packets up to now : 1006 242019-01-16 11:55:12.601096 DDOS Attack => nb of packets up to now : 1007 252019-01-16 11:55:12.601195 DDOS Attack => nb of packets up to now : 1008 262019-01-16 11:55:12.601228 DDOS Attack => nb of packets up to now : 1009 272019-01-16 11:55:12.601331 DDOS Attack => nb of packets up to now : 1010 282019-01-16 11:55:12.601364 DDOS Attack => nb of packets up to now : 1011 292019-01-16 11:55:12.601470 DDOS Attack => nb of packets up to now : 1012 302019-01-16 11:55:12.601505 DDOS Attack => nb of packets up to now : 1013 312019-01-16 11:55:12.601621 DDOS Attack => nb of packets up to now : 1014 322019-01-16 11:55:12.601656 DDOS Attack => nb of packets up to now : 1015 332019-01-16 11:55:12.601757 DDOS Attack => nb of packets up to now : 1016 342019-01-16 11:55:12.601790 DDOS Attack => nb of packets up to now : 1017 352019-01-16 11:55:12.601892 DDOS Attack => nb of packets up to now : 1018 362019-01-16 11:55:12.601925 DDOS Attack => nb of packets up to now : 1019 372019-01-16 11:55:12.602028 DDOS Attack => nb of packets up to now : 1020 38 39Remark : Use Ctrl-C to stop dddos.py 40