155 lines
5.9 KiB
Markdown
155 lines
5.9 KiB
Markdown
|
---
|
|||
|
|
tags: [计算机网络, DDoS, SYN Flood, HTTP Flood, MitM, ARP spoofing, DNS劫持]
|
|||
|
|
create time: 2026-05-18 04:55
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# DDoS 与中间人攻击（MitM）防御
|
|||
|
|
|
|||
|
|
## 概述
|
|||
|
|
|
|||
|
|
网络攻击的防护是 Defense in Depth——每一层都有自己的攻击面和对应的缓解措施。本章覆盖最常见的 L3/L4 DDoS、MitM（ARP/DNS 欺骗）、以及 DNS 劫持的技术原理和 Linux/运维层面的防御手段。
|
|||
|
|
|
|||
|
|
## DDoS（分布式拒绝服务）
|
|||
|
|
|
|||
|
|
### 各层攻击矩阵
|
|||
|
|
|
|||
|
|
```mermaid
|
|||
|
|
flowchart TD
|
|||
|
|
subgraph "L3/L4 流量型攻击"
|
|||
|
|
S["SYN Flood<br/>伪造源 IP 发大量 SYN"]
|
|||
|
|
U["UDP Flood<br/>海量 UDP 包淹没带宽"]
|
|||
|
|
I["ICMP Flood<br/>ping of death"]
|
|||
|
|
A["Amplification<br/>DNS/NTP amplification (>100x)"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
subgraph "L7 应用层攻击"
|
|||
|
|
H["HTTP Flood<br/>模拟正常请求压垮应用"]
|
|||
|
|
SL["Slowloris<br/>半开连接占满线程池"]
|
|||
|
|
RA["Resource Exhaustion<br/>解析超大 JSON/图片"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
style S fill:#FFD700,color:#000
|
|||
|
|
style H fill:#FF6B6B,color:#fff
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### L3/L4 DDoS 防御
|
|||
|
|
|
|||
|
|
| 攻击类型 | 原理 | 防御手段 |
|
|||
|
|
|---------|------|---------|
|
|||
|
|
| **SYN Flood** | 伪造源 IP 发送大量 SYN，耗尽半连接队列 | SYN Cookie, rate limit, 增大 tcp_max_syn_backlog |
|
|||
|
|
| **UDP Flood** | 海量 UDP 包吞没出口带宽 | upstream filtering, CDN 清洗 |
|
|||
|
|
| **ICMP Flood** | ping 风暴 | firewall rule, icmp_ratelimit |
|
|||
|
|
| **NTP Amplification** | 利用 open resolver 做放大反射 | BCP38 Source Guard |
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# Linux 内置防御命令
|
|||
|
|
$ sysctl net.ipv4.tcp_syncookies=1 # SYN Cookie: 内核自动处理 SYN Flood
|
|||
|
|
$ sysctl net.ipv4.tcp_max_syn_backlog=8192 # 增大 SYN 半连接队列
|
|||
|
|
$ sysctl net.ipv4.icmp_echo_ignore_all=1 # 极端：完全忽略所有 ping（不推荐）
|
|||
|
|
$ sysctl net.ipv4.icmp_ratelimit=1000 # 每秒最多处理 1000 个 ICMP 包
|
|||
|
|
|
|||
|
|
# iptables 限速规则
|
|||
|
|
sudo iptables -A INPUT -p tcp --syn -m limit --limit 100/s --limit-burst 200 -j ACCEPT
|
|||
|
|
sudo iptables -A INPUT -p tcp --syn -j DROP # 超过阈值丢包
|
|||
|
|
|
|||
|
|
# fail2ban —— 基于日志的动态封禁
|
|||
|
|
# /etc/fail2ban/jail.local
|
|||
|
|
[sshd]
|
|||
|
|
enabled = true
|
|||
|
|
maxretry = 3
|
|||
|
|
bantime = 3600
|
|||
|
|
findtime = 60
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### L7 DDoS 防御
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
┌─────────────────────────────────────────────────┐
|
|||
|
|
│ L7 攻击无法在单台服务器上有效防御 │
|
|||
|
|
│ │
|
|||
|
|
│ ✅ CDN (Cloudflare/AWS CloudFront) 清洗 │
|
|||
|
|
│ ✅ WAF (Web Application Firewall) 拦截异常请求 │
|
|||
|
|
│ ✅ Rate Limiting (API 限流, Redis + Lua) │
|
|||
|
|
│ ✅ CAPTCHA 人机验证 │
|
|||
|
|
│ ✅ 连接超时 (Go http.Server IdleTimeout) │
|
|||
|
|
│ │
|
|||
|
|
│ ❌ 自己写代码挡不住百万 QPS 的 HTTP Flood │
|
|||
|
|
└─────────────────────────────────────────────────┘
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
> [!tip] Slowloris 的原理与 Go 的免疫方式
|
|||
|
|
>
|
|||
|
|
> Slowloris 发起成千上万的 HTTP 连接，每个只发送部分请求头并保持活着——永远不发完整的 `\r\n\r\n`。这会让服务器的连接池被占满。
|
|||
|
|
>
|
|||
|
|
> **Go 天然免疫**：`http.Server.ReadHeaderTimeout` 会在超时后自动关闭未完成请求头的连接。这是 Go 高并发安全的一大优势。
|
|||
|
|
|
|||
|
|
## MITM（中间人攻击）
|
|||
|
|
|
|||
|
|
### ARP 欺骗实现 MITM
|
|||
|
|
|
|||
|
|
```mermaid
|
|||
|
|
sequenceDiagram
|
|||
|
|
participant C as 受害者主机<br/>192.168.1.100
|
|||
|
|
participant A as 攻击者<br/>192.168.1.200
|
|||
|
|
participant R as 真实网关<br/>192.168.1.1
|
|||
|
|
|
|||
|
|
C->>R: ARP: "Who has 192.168.1.1?"
|
|||
|
|
R-->>C: "I am 192.168.1.1, MAC=aa:bb:cc"
|
|||
|
|
|
|||
|
|
A->>C: Gratuitous ARP: "192.168.1.1 is ME aa:dd:ee!" ⚡
|
|||
|
|
Note over C: C 更新了 ARP 缓存 → 把网关 MAC 指向攻击者!
|
|||
|
|
|
|||
|
|
C->>A: 所有流量 → 攻击者的网卡 (二层交换)
|
|||
|
|
A->>R: 转发流量到真实网关 (ip_forward=1)
|
|||
|
|
R-->>A: 响应回传
|
|||
|
|
A-->>C: 解密/篡改后再转发给 C
|
|||
|
|
|
|||
|
|
Note over C,A,R: C 和 R 都以为在和对方通信 🚨
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**ARP 欺骗的检测与防御：**
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# 检测 ARP Spoofing
|
|||
|
|
arp -a # 查看本地 ARP 缓存表
|
|||
|
|
watch -n 1 'arp -n | grep 192.168.1' # 实时监控 ARP 条目变化
|
|||
|
|
|
|||
|
|
# 静态绑定（适用于服务器）
|
|||
|
|
arp -s 192.168.1.1 aa:bb:cc:dd:ee:ff # 手动固定网关 MAC
|
|||
|
|
# 写入 /etc/network/interfaces 持久化
|
|||
|
|
|
|||
|
|
# arpon/arpoison 工具检测
|
|||
|
|
arping -I eth0 -c 3 192.168.1.1 # 主动探测是否有重复响应
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### DNS 欺骗与污染
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
正常流程: DNS 污染:
|
|||
|
|
client → recursive DNS ─→ A record → 正确 IP client → malicious DNS ─→ wrong IP (跳转至攻击者)
|
|||
|
|
↑ ↑
|
|||
|
|
Cloudflare/Google DNS ISP/路由器被劫持
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# 检测 DNS 污染的对比方法
|
|||
|
|
$ dig example.com @8.8.8.8 # Google DNS —— 干净的参考结果
|
|||
|
|
$ dig example.com @1.1.1.1 # Cloudflare DNS —— 交叉验证
|
|||
|
|
$ dig example.com @local_dns # 本地 DNS —— 可能被污染
|
|||
|
|
|
|||
|
|
# 使用 DoH 防止 DNS 劫持
|
|||
|
|
$ curl https://dns.google/resolve?name=example.com&type=A \
|
|||
|
|
-H 'accept: application/dns-json'
|
|||
|
|
{"Status":0,"Answer":[{"name":"example.com","type":5,...}]}
|
|||
|
|
|
|||
|
|
# 使用 doh-proxy 或 cloudflared 为系统级别启用 DoH
|
|||
|
|
sudo systemctl enable --now cloudflared-dns-proxy
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 关联笔记
|
|||
|
|
|
|||
|
|
- [[hhs/NETWORK/TLS安全实践]] — TLS/HSTS/OCSP Stapling 是 MitM 的核心防线
|
|||
|
|
- [[hhs/NETWORK/HTTPS与TLS握手]] — 证书链验证如何抵抗 MitM
|
|||
|
|
- [[hhs/NETWORK/Web应用攻击面]] — L7 攻击面的补充（CSRF/XSS/XXE）
|
|||
|
|
- [[hhs/NETWORK/IPv6地址与扩展头部]] — ND（Neighbor Discovery）替代 ARP，同样有安全风险
|