1*387f9dfdSAndroid Build Coastguard WorkerDemonstrations of dddos.py, the Linux eBPF/bcc version. 2*387f9dfdSAndroid Build Coastguard Worker 3*387f9dfdSAndroid Build Coastguard WorkerThis tracks ip_rcv function (using kprobe) and elapsed time 4*387f9dfdSAndroid Build Coastguard Workerbetween received packets to detect potential DDOS attacks. 5*387f9dfdSAndroid Build Coastguard Worker 6*387f9dfdSAndroid Build Coastguard WorkerThe following steps illustrates the usage of dddos : 7*387f9dfdSAndroid Build Coastguard Worker1 - Start dddos.py : 8*387f9dfdSAndroid Build Coastguard Worker# ./dddos.py 9*387f9dfdSAndroid Build Coastguard WorkerDDOS detector started ... Hit Ctrl-C to end! 10*387f9dfdSAndroid Build Coastguard WorkerTIME(s) MESSAGE 11*387f9dfdSAndroid Build Coastguard Worker 12*387f9dfdSAndroid Build Coastguard Worker2 - Launch hping3 (or any other flooder) in another terminal as shown below: 13*387f9dfdSAndroid Build Coastguard Worker# hping3 localhost -S -A -V -p 443 -i u100 14*387f9dfdSAndroid Build Coastguard Worker 15*387f9dfdSAndroid Build Coastguard Worker3 - dddos.py triggers alerts and reports a DDOS attack: 16*387f9dfdSAndroid Build Coastguard WorkerDDOS detector started ... Hit Ctrl-C to end! 17*387f9dfdSAndroid Build Coastguard WorkerTIME(s) MESSAGE 18*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.600734 DDOS Attack => nb of packets up to now : 1001 19*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.600845 DDOS Attack => nb of packets up to now : 1002 20*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.600887 DDOS Attack => nb of packets up to now : 1003 21*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.600971 DDOS Attack => nb of packets up to now : 1004 22*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601009 DDOS Attack => nb of packets up to now : 1005 23*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601062 DDOS Attack => nb of packets up to now : 1006 24*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601096 DDOS Attack => nb of packets up to now : 1007 25*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601195 DDOS Attack => nb of packets up to now : 1008 26*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601228 DDOS Attack => nb of packets up to now : 1009 27*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601331 DDOS Attack => nb of packets up to now : 1010 28*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601364 DDOS Attack => nb of packets up to now : 1011 29*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601470 DDOS Attack => nb of packets up to now : 1012 30*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601505 DDOS Attack => nb of packets up to now : 1013 31*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601621 DDOS Attack => nb of packets up to now : 1014 32*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601656 DDOS Attack => nb of packets up to now : 1015 33*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601757 DDOS Attack => nb of packets up to now : 1016 34*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601790 DDOS Attack => nb of packets up to now : 1017 35*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601892 DDOS Attack => nb of packets up to now : 1018 36*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.601925 DDOS Attack => nb of packets up to now : 1019 37*387f9dfdSAndroid Build Coastguard Worker2019-01-16 11:55:12.602028 DDOS Attack => nb of packets up to now : 1020 38*387f9dfdSAndroid Build Coastguard Worker 39*387f9dfdSAndroid Build Coastguard WorkerRemark : Use Ctrl-C to stop dddos.py 40