RockCloud-基石云安全-官方博客
DDoS Attack Log Analysis and Traceback Methods: Layered Forensics and Response When Bandwidth Is Saturated
When a server's bandwidth is saturated or CPU is maxed out, this article provides a layered log-based forensics method to classify the attack type by analyzing inbound traffic characteristics, L4 connection states, and L7 access records, and map them to actionable response actions.
How to Determine if It's a Slowloris CC Attack: Don't Just Check access.log
When server response slows down with connection buildup but low bandwidth and QPS, slowloris CC attacks often hide from access.log. This article provides troubleshooting steps starting from connection state, using ss commands, worker usage, and FD curves to locate connection exhaustion, along with layered mitigation strategies for origin limiting and edge buffering.
Architecture for Handling Tbps-Scale DDoS Attacks: Single Data Center or Multi-Region Edge Offload?
Handling Tbps-scale DDoS attacks requires distributed edge-based offload across multiple locations; a single data center will break at the upstream link first. This article breaks down the four-layer responsibilities and provides a selection comparison table and a self-check checklist.
How to Prevent Real Origin IP Exposure: 5 Leak Points to Self-Check and Origin Closures
A practical checklist to identify and close origin IP leaks, and lock down access to ensure CDN protection isn't bypassed.
NTP Reflection Amplification Attack Principles and Defense: Shut Down Amplifiers in 4 Steps
Learn how to mitigate NTP reflection amplification attacks by understanding the amplification mechanism, identifying whether you are a victim or a reflector, closing the monlist vulnerability, and moving traffic scrubbing to the network edge.
