From Firewalls: Jumpstart for Network and Systems Administrators

Firewalls protect networks from incoming packets. In contrast, the reverse firewall protects the outside network from packet flooding distributed denial-of-service (DDoS) attacks that originate on the inside. The reverse firewall drastically reduces the impact of DDoS attacks mounted from inside the network. DDoS attacks are usually conducted through zombies (i.e., computers that have come under the control of the attacker). The reverse firewall chokes off packet flooding attacks before they exit the network where they originate. This appendix describes the reverse firewall, how it works, and its benefits as a DDoS defense to the infrastructure owner and to the Internet.

DoS and DDoS packet flooding attacks are an increasing problem. A recent study by industry analysts estimates more than 5000 attacks a week. Many sites of commercial importance have become targets, including CNN, eBay, Yahoo, and Microsoft. Establishing DDoS attacks is a serious threat to e-commerce and e-business. The Computer Emergency Response Team (CERT), the Internet security watchdog, was itself targeted in successful DDoS attacks in March 2001. CERT warns repeatedly that there is currently no technology to deal with this problem and recommends general vigilance and administrative measures to minimize the potentially devastating impact of a DDoS attack.

The Internet infrastructure has vulnerabilities that make it very difficult to defend against packet flooding attacks. As stated previously, most DDoS attacks are carried out via slaves or zombies. Using these machines, the attacker can launch a coordinated but well-disguised attack on a victim and avoid detection. With near universal availability...

Products & Services
Network Security Services
Network security services determine vulnerability of networks to outside intruders, as well as maintain anti-viral and firewall updates and usage.
Network Firewalls
Network firewalls protect computer networks against unauthorized use or attack. They permit or deny access to private network devices and applications, and represent an important part of an organization's overall security policy. Firewalls may be software applications, hardware devices (such as routers), or a combination of both. They include turnkey products that are relatively easy to install as well as complex, multi-layer installations that require the expertise of a certified network administrator. 
Network Appliances
Network appliances are inexpensive personal computers (PC) or computer boards that provide Internet access and promote network security. They lack many of the features of fully-equipped PCs, however.
Network Security Software
Network security software includes everything from remote access protection to firewall and security appliance solutions to email security to web filtering, monitoring, bandwidth protection, and all elements of computer network security/computer security.
Packet Generators
Packet generators create a discrete chunk of communication in a pre-defined format.

Topics of Interest

A denial-of-service (DoS) attack is one that is intended to compromise the availability of a computing resource. Common DoS attacks include ping floods and mail bombs both intended to consume...

JUNGTAEK SEO AND CHEOLHO LEE National Security Research Institute KT 463-1 Jeonmin-dong, Yuseong-gu, Daejeon, 305 811, Republic of KOREA E-mail: seojt{chlee} TAESHIK SHON AND JONGSUB MOON...

Scanning Systems for DDoS Attack Software Using a Zombie Zapper Since late 1999, many sites have become the victims of devastating denial-of-service (DoS) attacks. A DoS attack is basically where an...

Solutions Fast Track Scanning for Viruses Using the AntiVir Antivirus Application Virus scanners will perform the following tasks: check the system s boot record; search directories and...

Introduction You are probably familiar with the attacks of February 2000 on eBay, Yahoo, Amazon, and other major e-commerce and non e-commerce Web sites. Those attacks were all distributed denial of...