Windows Firewall vs Linux IP - Tables

[AchTung]

Hey,
right now I'm stuck at a point of my presentation in the subject Computer technology (dunno how to say in English). Well as the headline already announce, I do not know any advantage/disadvantage for Windows or Linux.

My topic is DDoS and Im stuck at this questions:

My questions:

• Which of them is more effective to handle DDoS? Why?

• Which systems does the big companies use, as an example Windows?

• What are the advantages/disadvantages of Windows Firewalls?

• What are the advantages/disadvantages of Linux IP - Tables Firewall?

Would be nice if you could help me out. It would be awesome if you would not flame, since its a school topic and I need some kind of help.

 

[devianceone]

I think it could depend on a lot of things, what windows firewall are you talking about? I don't know much about linux, but I do know windows, by default has a terrible firewall that is practically useless for anything. You can see here for a comparison for things like iptables and windows xp/vista/win7 firewall. Comparison of firewalls - Wikipedia, the free encyclopedia . I think most companies will use linux, not as a their choice to stop ddos though just generally because its more secure/locked down, faster and mostly open source. I don't think you'll be wanting to stop a large ddos at the iptable/windows firewall anyways, if its hosted in a large data center they'll probably have the resources needed to stop it before it reachs you, or just drop all traffic until it stops. If you're hosting in a business location, you're probably out of luck, one does not simply stop 10gbit+ with a software firewall.

 

[AchTung]

Thanks for the link. I didn't researched perfectly. I believe aswell that Linux is better. As I heard, the big companies split there traffic on different servers though. Hope few more people will answer.

 

[AchTung]

bump

 

[Red]

snort.org

Red

 

[Cykotitan]

Windows Firewall? I think you misspelled "IPSec", altough it doesn't natively support iptables-like automatic intrustion detection and prevention (but it's possible to create some very basic scripts to automatically add IPSec rules, like I did

string.trim = function (str)
	return str:gsub("^%s*(.-)%s*$", "%1")
end

string.explode = function (str, sep)

	local pos, tmp, t = 1, "", {}
	for s, e in function() return string.find(str, sep, pos) end do
		tmp = str:sub(pos, s - 1):trim():gsub(':%d+$', '')
		table.insert(t, tmp)
		pos = e + 1
	end

	tmp = str:sub(pos):trim()
	table.insert(t, tmp)
	return t
end

while true do
	local f = assert (io.popen ("netstat -n -p TCP"))
	local t={}
	for p in f:lines() do
		if p:sub(3,3) == 'T' then
			p=p:sub(3):gsub('  ', ' ')
			local v = string.explode(p, ' ')
			if v[3]~='127.0.0.1' and v[4]=='ESTABLISHED' then
				t[v[3]]=(t[v[3]] or 0)+1
				if t[v[3]] >= 25 then
					local b
					for r in io.lines('ban.log') do
						if r:sub(1,v[3]:len())==v[3] then
							b=true
							break
						end
					end
					if not b then
						local k=io.open('ban.log','a')
						k:write(v[3] .. ' ' .. t[v[3]]..' ' .. os.date()..'\n')
						k:close()
						os.execute('netsh ipsec static add filter filterlist=Block srcaddr='..v[3]..' dstaddr=me protocol=any mirrored=yes')
						break
					end
				end
			end
		end
	end
	f:close()
	os.execute('sleep 3')
	os.execute('cls')
end

 

[Derek Boom Boom]

Windows Firewall? I think you misspelled "IPSec", altough it doesn't natively support iptables-like automatic`intrustion detection and prevention (but it's possible to create some very basic scripts to automatically add IPSec rules, like I did

string.trim = function (str)
	return str:gsub("^%s*(.-)%s*$", "%1")
end

string.explode = function (str, sep)

	local pos, tmp, t = 1, "", {}
	for s, e in function() return string.find(str, sep, pos) end do
		tmp = str:sub(pos, s - 1):trim():gsub(':%d+$', '')
		table.insert(t, tmp)
		pos = e + 1
	end

	tmp = str:sub(pos):trim()
	table.insert(t, tmp)
	return t
end

while true do
	local f = assert (io.popen ("netstat -n -p TCP"))
	local t={}
	for p in f:lines() do
		if p:sub(3,3) == 'T' then
			p=p:sub(3)
			local v = p:find('  ')
			while v do
				p = p:gsub('  ', ' ')
				v = p:find('  ')
			end
			v = string.explode(p, ' ')
			if v[3]~='127.0.0.1' and v[4]=='ESTABLISHED' then
				t[v[3]]=(t[v[3]] or 0)+1
				if t[v[3]] >= 25 then
					local b
					for r in io.lines('ban.log') do
						if r:sub(1,v[3]:len())==v[3] then
							b=true
							break
						end
					end
					if not b then
						local k=io.open('ban.log','a')
						k:write(v[3] .. ' ' .. t[v[3]]..' ' .. os.date()..'\n')
						k:close()
						os.execute('netsh ipsec static add filter filterlist=Block srcaddr='..v[3]..' dstaddr=me protocol=any mirrored=yes')
						break
					end
				end
			end
		end
	end
	f:close()
	os.execute('sleep 3')
	os.execute('cls')
end

>Implying they will know how to run it with Lua Interpreter.

 

[Cykotitan]

>Implying they will know how to run it with Lua Interpreter.

>Implying they will know how to setup IPSec rules and filter lists with proper names too.