What is the biggest attack in GBPS you stopped
-
Can someone give a proper summary of what the problem actually is so others don't have to wade through 20+ pages to find the info?
Specifically: Is the traffic in question actually passed, or blocked? Is a service on the firewall running pfSense (such as the GUI) exposed to the test source or is the traffic being passed through to an internal host (port forward, routed, etc)? – This is important because a SYN flood to pfSense as a host is completely different than a flood through pfSense as a forwarder/firewall.
If the traffic is passing through the firewall, using rules to clamp down state limits, or going stateless properly (floating quick OUT rules to pass out with no state along with the pass in rules on the other tabs) may help.
If the traffic is targeting the firewall itself, then there are things that can be tweaked (syncache parameters, for example), but it's yet another reason the services on the firewall such as the GUI and SSH should not be exposed to the Internet in general. State limits can help there as well.
Also the "size" of an attack in Mbit/s or Gbit/s is not as important to know as the PPS rate which tends to be the limiting factor when dealing with small packets such as this.
Some answers to your questions based on today's testing:
Is the traffic in question actually passed, or blocked? Both. It was mostly blocked but the SYN flood was stopped. There were several different kinds of attacks, but the SYN was blocked.
Is a service on the firewall running pfSense (such as the GUI) exposed to the test source or is the traffic being passed through to an internal host (port forward, routed, etc)? Traffic was focused on the external IP to ports 80 and 443. No services were exposed on either WAN interface. The external IP of WAN2 forwarded ports 80 and 443 to an internal address running a web server.
This is important because a SYN flood to pfSense as a host is completely different than a flood through pfSense as a forwarder/firewall. I believe, but cannot be certain, that when my WAN1 interface was attacked with the same SYN flood we had the same issue. WAN1 does not forward any ports. I didn't have Wireshark running at this time on that interface, but we can always retest.
-
I don't know if they were the same tests, but my i5 3.2ghz i350-T2 NIC took tens of megabits. I didn't think to have my console on, so I don't know if there was an interrupt storm. The i350 seems to be really good at keeping interrupts low I don't know how, but the interrupt rate is pretty much identical between load and idle during normal usage. But not sure under the attack.
-
I don't know if they were the same tests, but my i5 3.2ghz i350-T2 NIC took tens of megabits. I didn't think to have my console on, so I don't know if there was an interrupt storm. The i350 seems to be really good at keeping interrupts low I don't know how, but the interrupt rate is pretty much identical between load and idle during normal usage. But not sure under the attack.
I specifically wanted to run top during the attack to determine if the issue was load or a specific process. CPU never hit 50%. I was hit with 118Mbit attacks, and the other 3 interfaces were fine as well as the pfSense box.
But I strongly recommend running the console during a test attack.
-
So it looks like an i5 handles better than an i3 but dont know if the i5 also has same amount of ram or not?
Its generally useful to post the hw specs perhaps in the sig as I've found this useful for debugging problems in programming languages.
I'll be trying this later on today in a couple of VM's (virtual pc's running on vm ware) as I can control number of core's, network speed and other tweaks, not to mention setup many many nics and having 32Gb on my dev machine so I can give the virtual pfsense more ram & more cores to see if that or other hw like spin disks or ssd's becomes a factor.
Anyone get anywhere with the syn flooding & dtrace links I pm'ed to almabes?
-
Tim is running pfsense on bare metal. Almabes is running in a VM.
We have tested the two scenarios before, and both were taken offline.
Almabes modem died during the test and didnt com back online unless he manually rebooted it. He runs Cisco.
I run dual Xeon's
http://ark.intel.com/products/33927/Intel-Xeon-Processor-E5420-12M-Cache-2_50-GHz-1333-MHz-FSB
A little note here that could contain a clue.
When I disabled services as per the picture, then the box recovered really quickly in the VM.
The overall load was lower as expected but after the CPU spiked during the attack, the recovery period was significantly shorter without the services running.
-
Somewhat interesting findings this morning…
I turned Apinger Daemon on again as the only thing and the box died on me completely when attacked.
Recovery time was very long and 2-3 minutes extra downtime before the box was responding again.
-
Turned of Apinger and turned on Cron.
Much more responsive GUI and the traffic graphs didnt die on me completely this time.
Recovered instantly after the attack was stopped.
-
When enabling NTP, the box responsiveness became worse.
Not updating the graphs as quickly and a little worse in recovery time as seen in the little bend in the right hand corner of the last CPU graph from VmWare. It was a 15-20 second longer recovery.
-
Enabled Snort to see if it made things worse.
The answer to that is yes and no… initial phase was really good, since it took out the initial spike in CPU and made the load more even (slower boost). CPU had a shorter MAX load interval than on previous attacks.
It activated a more even CPU usage on the 8 cores and recovery was really good.
Traffic graphs didnt fare as well as with Cron only running.
-
When Snort AND Cron were enabled the graphs looked like this…
Total load was higher, but recovery was fine but initial CPU offloading was not there anymore.
-
Enabling Apinger did not do any good to the box as expected.
More CPU on top and a minute longer to recover. For what its worth, the impact didnt seem as big as the first test but still a trend (big).
Traffic graphs very unresponsive as the rest of the GUI. It dies on the first CPU spike in the GUI.
-
So maybe some services are more resource hungry and/or less refined in the scheme of things.
I wonder if there would be any benefit in having two firewalls in series, where the forward facing/1st was stripped of all unnecessary tasks/services, then the 2nd inline firewall had the unnecessary services/tasks running on it?
It certainly seems like there might not be any one property, service/task which is at fault, but maybe a combination of things which can affect how well the system stays up.
Have you seen the links I pm'ed almabes regarding setting up pfsense to reduce/avoid syn floods? If so did you give them ago and how did they perform?
-
I did not see the links.
States is about 1% on the box and it has limiters to how many states can be created pr. rule.
Running SYn Proxy state with allowance of 50 new connections pr. sec.
That allows the state table to have some "air" but it doesnt help much.
-
I have come a BIG step closer to locating the culprit.
Look at the graphs when NTPD is enabled.
It destroys the GUI completely and takes the interfaces offline in the GUI. No response from them. The graphs is a 3 minute attack and only maybe 10 seconds are showing.
Whats really interesting is the VmWare graph. When it spikes for the last time, the GUI comes back and the CPU graph in the GUI starts working again.
Wonder if NTPD and Apinger together could make something?
-
Deleted the Vmware Tools package and tested again.
Did a little better this time with NTPD and Apinger running.
Little spike before the last one is a reboot. Recovery took about a minute longer than usual.
-
After deleting the Vmware Tools then I disabled Apinger and NTPD.
The graphs on ESXi looked the same as "normal". No jitter from Apinger and NTPD afterwards.
Recovery was instant. Traffic graphs didnt respond well.
-
Ping from LAN -> WAN during the flood.
Next will be disabling traffic limitations in the SynProxy settings.
-
Running stateless with the box not having any limits to states pr sec. and other things pr. rule settings…
Box ran fine. Responsive. A little fallout on the traffic graphs but not so bad as seen before.
CPU load is a LOT less and only 5 dropped packets to Google via ping.
Instead of beeing crippled to a halt, it actually routed traffic to the server behind.
Whats a little odd, is that the traffic doubled in bandwith from around 4-5mbit/s to around 8-10mbit/s running stateless compared to SynProxy state.
-
APINGER running and the box is useless….
This is the difference running stateless and apinger vs no apinger.
Spike in CPu is 20% or more on ESXi and recovery takes about a minute longer...
-
Last one for today…
Enabling NTPD was also something that crippled the box.
Whats really interesting in the graphs in VmWare. The last 3 is the following:
1: Stateless NOT running Apinger and NTPD. No CPU hits 100% and the box is responsive and routes traffic.
2: Stateless Runing Apinger but NOT NTPD. 1 CPU (nr. 4) is 100% and the box stops routing and loses packets.
3: Stateless NOT running Apinger but running NTPD. 1 CPU is 100% (nr. 3) and the box stops responding and loses packets.1st graph doesnt have the small "bump" at the end of the attack and is responsive all along. When enabling Apinger OR NTPD OR both, then the box dies and recovery time is long (minutes). Recovery time is longer when running Apinger than with NTPD running.
When running SynProxy state the same pattern can be seen when attacked. Some CPU runs 100% and the box is dead.
Last image is a better view of the cpu usage.
1st one maxes out and packet loss occurs. 2nd does not and routes everything fine. 3rd is initially fine, but as soon as 1 cpu hits 100%, then the box is gone. (about halfway into the attack).
