[vc_row][vc_column][vc_column_text css=””]<\/p>\n
\u5728\u5168\u7403\u7db2\u8def\u57fa\u790e\u8a2d\u65bd\u9818\u57df,\u7f8e\u570b\u4f3a\u670d\u5668<\/a>\u5c08\u7ddaIP\u662f\u4f01\u696d\u5be6\u73fe\u53ef\u9760\u3001\u9ad8\u6548\u80fd\u4f3a\u670d\u5668\u79df\u7528\u89e3\u6c7a\u65b9\u6848\u7684\u95dc\u9375\u7d44\u6210\u90e8\u5206\u3002\u672c\u6280\u8853\u5206\u6790\u63a2\u8a0e\u4e86\u7f8e\u570b\u4f3a\u670d\u5668\u4e2d\u5c08\u7ddaIP\u914d\u7f6e<\/a>\u7684\u67b6\u69cb\u3001\u5be6\u65bd\u548c\u6700\u4f73\u5316,\u91cd\u9ede\u95dc\u6ce8\u7db2\u8def\u5ef6\u9072\u3001\u8de8\u5883\u8a17\u7ba1\u548c\u4f3a\u670d\u5668\u6700\u4f73\u5316\u65b9\u6cd5\u3002<\/p>\n \u5c08\u7ddaIP\u5efa\u7acb\u4e86\u57fa\u790e\u8a2d\u65bd\u8207\u7f8e\u570b\u4f3a\u670d\u5668\u4f4d\u7f6e\u4e4b\u9593\u7368\u7279\u7684\u3001\u5c08\u7528\u7684\u7db2\u8def\u901a\u9053\u3002\u8207\u5171\u4eabIP\u914d\u7f6e\u76f8\u6bd4,\u9019\u7a2e\u914d\u7f6e\u63a1\u7528\u4e86\u5b8c\u5168\u4e0d\u540c\u7684\u539f\u7406,\u4f7f\u7528\u5c08\u7528\u786c\u9ad4\u8cc7\u6e90\u548c\u7db2\u8def\u8def\u7531\u3002<\/p>\n \u5c08\u7ddaIP\u67b6\u69cb\u5305\u542b\u591a\u500b\u5354\u540c\u5de5\u4f5c\u7684\u95dc\u9375\u5143\u4ef6:<\/p>\n \u6bcf\u500b\u5c08\u7ddaIP\u914d\u7f6e\u7dad\u8b77\u81ea\u5df1\u7684\u8def\u7531\u8868\u548cBGP\u95dc\u4fc2,\u78ba\u4fdd\u5230\u4e3b\u8981\u7db2\u969b\u7db2\u8def\u4ea4\u63db\u4e2d\u5fc3\u7684\u6700\u4f73\u8def\u5f91\u9078\u64c7\u548c\u8f03\u5c11\u7684\u8df3\u6578\u3002<\/p>\n \u5728\u8a55\u4f30\u5c08\u7ddaIP\u6548\u80fd\u6642,\u9700\u8981\u95dc\u6ce8\u4ee5\u4e0b\u5e7e\u500b\u95dc\u9375\u6307\u6a19:<\/p>\n \u7f8e\u570b\u5c08\u7ddaIP\u7dda\u8def\u7684\u5178\u578b\u6548\u80fd\u57fa\u6e96\u61c9\u986f\u793a:<\/p>\n \u5f9e\u6280\u8853\u89d2\u5ea6\u4f86\u770b,\u5c08\u7ddaIP\u63d0\u4f9b\u4e86\u591a\u9805\u71df\u904b\u512a\u52e2:<\/p>\n \u512a\u52e2\u5206\u6790:<\/strong><\/p>\n 1. TCP\u9023\u7dda\u7ba1\u7406<\/strong><\/p>\n – \u5c08\u7528\u9023\u7dda\u6c60<\/p>\n – \u7121\u9023\u63a5\u57e0\u5171\u4eab\u885d\u7a81<\/p>\n – \u81ea\u8a02TCP\u8996\u7a97\u5927\u5c0f<\/p>\n 2. SSL\/TLS\u5be6\u65bd<\/strong><\/p>\n – \u7368\u7acb\u6191\u8b49\u7ba1\u7406<\/p>\n – \u81ea\u8a02\u52a0\u5bc6\u5957\u4ef6\u9078\u64c7<\/p>\n – \u5b8c\u7f8e\u524d\u5411\u4fdd\u5bc6\u652f\u63f4<\/p>\n 3. DNS\u914d\u7f6e<\/strong><\/p>\n – \u76f4\u63a5PTR\u8a18\u9304\u63a7\u5236<\/p>\n – \u81ea\u8a02DNS\u89e3\u6790\u8def\u5f91<\/p>\n – \u5730\u7406\u4f4d\u7f6eDNS\u6700\u4f73\u5316<\/p>\n \u5be6\u65bd\u5c08\u7ddaIP\u89e3\u6c7a\u65b9\u6848\u9700\u8981\u8b39\u614e\u914d\u7f6e\u7db2\u8def\u53c3\u6578\u3002\u4ee5\u4e0b\u662f\u8a73\u7d30\u7684\u914d\u7f6e\u6307\u5357:<\/p>\n \u5c0d\u65bc\u570b\u969b\u8a17\u7ba1\u90e8\u7f72,\u8acb\u8003\u616e\u4ee5\u4e0b\u6280\u8853\u67b6\u69cb:<\/p>\n \u8de8\u5883\u8a17\u7ba1\u7684\u5be6\u65bd\u9700\u8981\u4ed4\u7d30\u8003\u616e\u76e3\u7ba1\u5408\u898f\u6027\u548c\u8cc7\u6599\u4e3b\u6b0a\u8981\u6c42\u3002<\/p>\n \u5efa\u7acb\u5065\u5168\u7684\u76e3\u63a7\u7cfb\u7d71\u5c0d\u65bc\u7dad\u6301\u6700\u4f73\u6548\u80fd\u81f3\u95dc\u91cd\u8981:<\/p>\n \u5c08\u7ddaIP\u7684\u5b89\u5168\u914d\u7f6e\u9700\u8981\u591a\u5c64\u6b21\u7684\u65b9\u6cd5:<\/p>\n \u7406\u89e3\u5c08\u7ddaIP\u7684\u6280\u8853\u6295\u8cc7\u5831\u916c\u6d89\u53ca\u5206\u6790\u591a\u500b\u6307\u6a19:<\/p>\n \u6295\u8cc7\u5831\u916c\u8a08\u7b97\u56e0\u7d20:<\/strong><\/p>\n 1. \u6548\u80fd\u63d0\u5347<\/strong><\/p>\n – \u5ef6\u9072\u964d\u4f4e: ~40-60%<\/p>\n – \u541e\u5410\u91cf\u63d0\u5347: 2-3\u500d<\/p>\n – \u9023\u7dda\u7a69\u5b9a\u6027: 99.99%<\/p>\n 2. \u8cc7\u6e90\u5229\u7528<\/strong><\/p>\n – \u983b\u5bec\u6548\u7387: +35%<\/p>\n – \u4f3a\u670d\u5668\u8ca0\u8f09\u6e1b\u5c11: ~25%<\/p>\n – \u5feb\u53d6\u547d\u4e2d\u7387: +45%<\/p>\n 3. \u71df\u904b\u6548\u76ca<\/strong><\/p>\n – \u652f\u63f4\u5de5\u55ae\u6e1b\u5c11: -40%<\/p>\n – \u554f\u984c\u89e3\u6c7a\u901f\u5ea6\u63d0\u5347: -60%<\/p>\n – \u76e3\u63a7\u80fd\u529b\u63d0\u5347: +80%<\/p>\n \u5be6\u65bd\u5c08\u7ddaIP\u89e3\u6c7a\u65b9\u6848\u61c9\u8003\u616e\u672a\u4f86\u64f4\u5c55\u9700\u6c42:<\/p>\n \u7e3d\u4e4b,\u7f8e\u570b\u4f3a\u670d\u5668\u5c08\u7ddaIP\u5c0d\u65bc\u9700\u8981\u53ef\u9760\u3001\u9ad8\u6548\u80fd\u4f3a\u670d\u5668\u79df\u7528\u89e3\u6c7a\u65b9\u6848\u7684\u7d44\u7e54\u4f86\u8aaa\u662f\u4e00\u500b\u95dc\u9375\u7684\u57fa\u790e\u8a2d\u65bd\u9078\u64c7\u3002\u900f\u904e\u6b63\u78ba\u5be6\u65bd\u7db2\u8def\u6700\u4f73\u5316\u3001\u5b89\u5168\u63aa\u65bd\u548c\u76e3\u63a7\u7cfb\u7d71,\u4f01\u696d\u53ef\u4ee5\u5be6\u73fe\u986f\u8457\u7684\u6548\u80fd\u6539\u9032\u4e26\u7dad\u6301\u7a69\u5065\u7684\u8de8\u5883\u71df\u904b\u3002\u5c08\u7ddaIP\u914d\u7f6e\u7684\u6280\u8853\u512a\u52e2,\u7d50\u5408\u7f8e\u570b\u8a17\u7ba1\u8a2d\u65bd\u7684\u7b56\u7565\u4f4d\u7f6e,\u70ba\u9700\u8981\u512a\u8cea\u7db2\u8def\u9023\u7dda\u548c\u8cc7\u6e90\u9694\u96e2\u7684\u4f3a\u670d\u5668\u79df\u7528\u548c\u4f3a\u670d\u5668\u8a17\u7ba1\u670d\u52d9\u5275\u9020\u4e86\u6700\u4f73\u74b0\u5883\u3002<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":" [vc_row][vc_column][vc_column_text css=””] […]<\/p>\n\u7406\u89e3\u5c08\u7ddaIP\u67b6\u69cb<\/strong><\/h2>\n
\u6280\u8853\u5143\u4ef6\u548c\u7db2\u8def\u7d50\u69cb<\/strong><\/h2>\n
\r\n\u7db2\u8def\u67b6\u69cb\u6982\u8ff0:\r\n\u251c\u2500\u2500 \u4e3b\u8981\u5143\u4ef6\r\n\u2502 \u251c\u2500\u2500 \u5c08\u7528\u8def\u7531\u5668(1:1\u5206\u914d)\r\n\u2502 \u251c\u2500\u2500 \u5be6\u9ad4\u983b\u5bec\u901a\u9053\r\n\u2502 \u2514\u2500\u2500 \u5c08\u7528IP\u4f4d\u5740\u5340\u584a(\/29\u6216\u66f4\u5927)\r\n\u251c\u2500\u2500 \u5b89\u5168\u5c64\r\n\u2502 \u251c\u2500\u2500 \u5c08\u7528\u9632\u706b\u7246\r\n\u2502 \u2514\u2500\u2500 DDoS\u9632\u8b77\r\n\u2514\u2500\u2500 \u76e3\u63a7\u7cfb\u7d71\r\n \u251c\u2500\u2500 \u5373\u6642\u5ef6\u9072\u8ffd\u8e64\r\n \u2514\u2500\u2500 \u983b\u5bec\u4f7f\u7528\u5206\u6790\r\n<\/code><\/pre>\n\u6548\u80fd\u6307\u6a19\u548c\u57fa\u6e96\u6e2c\u8a66<\/strong><\/h2>\n
\r\n# \u7db2\u8def\u6548\u80fd\u6e2c\u8a66\u8173\u672c\u793a\u4f8b\r\n#!\/bin\/bash\r\n\r\n# \u6e2c\u8a66\u5230\u4e3b\u8981\u7f8e\u570b\u4ea4\u63db\u4e2d\u5fc3\u7684\u5ef6\u9072\r\nfor endpoint in ny-ix.net lax-ix.net chi-ix.net; do\r\n echo \"\u6e2c\u8a66\u5230 $endpoint \u7684\u5ef6\u9072\"\r\n ping -c 10 $endpoint | grep \"avg\"\r\ndone\r\n\r\n# \u76e3\u63a7\u983b\u5bec\u98fd\u548c\u5ea6\r\niftop -i eth0 -N -n\r\n\r\n# \u6aa2\u67e5\u8def\u7531\u6548\u7387\r\ntraceroute -T -p 443 target-server.com\r\n<\/code><\/pre>\n\n
\u6280\u8853\u71df\u904b\u5be6\u65bd\u512a\u52e2<\/strong><\/h2>\n
\u9032\u968e\u914d\u7f6e\u548c\u6700\u4f73\u5316<\/strong><\/h2>\n
\r\n# \u7db2\u8def\u6700\u4f73\u5316\u914d\u7f6e\u793a\u4f8b\r\n# \/etc\/sysctl.conf \u6700\u4f73\u5316\r\n\r\n# \u589e\u52a0TCP\u8996\u7a97\u5927\u5c0f\r\nnet.core.wmem_max = 12582912\r\nnet.core.rmem_max = 12582912\r\nnet.ipv4.tcp_rmem = 10240 87380 12582912\r\nnet.ipv4.tcp_wmem = 10240 87380 12582912\r\n\r\n# \u555f\u7528TCP BBR\u4ee5\u63d0\u9ad8\u541e\u5410\u91cf\r\nnet.core.default_qdisc = fq\r\nnet.ipv4.tcp_congestion_control = bbr\r\n\r\n# \u6700\u4f73\u5316\u7db2\u8def\u7de9\u885d\u5340\u8a2d\u5b9a\r\nnet.core.netdev_max_backlog = 5000\r\nnet.ipv4.tcp_max_syn_backlog = 8096\r\nnet.ipv4.tcp_max_tw_buckets = 2000000\r\n<\/code><\/pre>\n\u8de8\u5883\u5be6\u65bd\u7b56\u7565<\/strong><\/h2>\n
\r\n\u5168\u7403\u90e8\u7f72\u67b6\u69cb:\r\n\u2514\u2500\u2500 \u7f8e\u570b\u4e3b\u8cc7\u6599\u4e2d\u5fc3\r\n \u251c\u2500\u2500 \u908a\u7de3\u7bc0\u9ede\r\n \u2502 \u251c\u2500\u2500 \u4e9e\u592a\u5730\u5340\r\n \u2502 \u2502 \u2514\u2500\u2500 Anycast\u914d\u7f6e\r\n \u2502 \u2514\u2500\u2500 \u6b50\u975e\u4e2d\u6771\u5730\u5340\r\n \u2502 \u2514\u2500\u2500 GeoDNS\u8def\u7531\r\n \u251c\u2500\u2500 \u8ca0\u8f09\u5206\u914d\r\n \u2502 \u251c\u2500\u2500 GSLB\u5be6\u65bd\r\n \u2502 \u2514\u2500\u2500 \u6d41\u91cf\u5de5\u7a0b\r\n \u2514\u2500\u2500 \u6545\u969c\u8f49\u79fb\u914d\u7f6e\r\n \u251c\u2500\u2500 \u81ea\u52d5\u6545\u969c\u6062\u5fa9\r\n \u2514\u2500\u2500 \u5065\u5eb7\u76e3\u63a7\r\n<\/code><\/pre>\n\u6548\u80fd\u76e3\u63a7\u548c\u6545\u969c\u6392\u9664<\/strong><\/h2>\n
\r\n#!\/bin\/bash\r\n# \u7d9c\u5408\u76e3\u63a7\u8173\u672c\r\n\r\n# \u5b9a\u7fa9\u76e3\u63a7\u53c3\u6578\r\nLATENCY_THRESHOLD=50\r\nPACKET_LOSS_THRESHOLD=0.5\r\nBANDWIDTH_THRESHOLD=90\r\n\r\n# \u76e3\u63a7\u7db2\u8def\u6307\u6a19\r\nmonitor_network() {\r\n # \u6aa2\u67e5\u5ef6\u9072\r\n current_latency=$(ping -c 5 target-server.com | tail -1 | awk '{print $4}' | cut -d '\/' -f 2)\r\n \r\n # \u6aa2\u67e5\u4e1f\u5305\u7387\r\n packet_loss=$(ping -c 100 target-server.com | tail -1 | awk '{print $6}' | cut -d '%' -f 1)\r\n \r\n # \u6aa2\u67e5\u983b\u5bec\u4f7f\u7528\u7387\r\n bandwidth_usage=$(iftop -t -s 5 -L 5 -P)\r\n \r\n # \u8d85\u904e\u95be\u503c\u6642\u767c\u51fa\u8b66\u5831\r\n [ $current_latency -gt $LATENCY_THRESHOLD ] && send_alert \"\u9ad8\u5ef6\u9072\"\r\n [ $packet_loss -gt $PACKET_LOSS_THRESHOLD ] && send_alert \"\u4e1f\u5305\"\r\n}\r\n\r\n# \u6bcf5\u5206\u9418\u57f7\u884c\u4e00\u6b21\u76e3\u63a7\r\nwhile true; do\r\n monitor_network\r\n sleep 300\r\ndone\r\n<\/code><\/pre>\n\u5b89\u5168\u5be6\u65bd\u548c\u6700\u4f73\u5be6\u52d9<\/strong><\/h2>\n
\r\n# \u5b89\u5168\u914d\u7f6e\u7bc4\u672c\r\n# \/etc\/iptables\/rules.v4\r\n\r\n*filter\r\n:INPUT DROP [0:0]\r\n:FORWARD DROP [0:0]\r\n:OUTPUT ACCEPT [0:0]\r\n\r\n# \u5141\u8a31\u5df2\u5efa\u7acb\u7684\u9023\u7dda\r\n-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\r\n\r\n# DDoS\u9632\u8b77\u7684\u81ea\u8a02\u901f\u7387\u9650\u5236\r\n-A INPUT -p tcp --dport 80 -m limit --limit 25\/minute --limit-burst 100 -j ACCEPT\r\n\r\n# \u5730\u7406IP\u904e\u6ffe\u793a\u4f8b\r\n-A INPUT -m geoip --src-cc CN,RU -j DROP\r\n\r\n# \u61c9\u7528\u7a0b\u5f0f\u7279\u5b9a\u898f\u5247\r\n-A INPUT -p tcp --dport 443 -j ACCEPT\r\n-A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set\r\nCOMMIT\r\n<\/code><\/pre>\n\u6210\u672c\u6548\u76ca\u5206\u6790\u548c\u6295\u8cc7\u5831\u916c\u7387\u8a08\u7b97<\/strong><\/h2>\n
\u9762\u5411\u672a\u4f86\u7684\u64f4\u5c55\u6027\u8003\u616e<\/strong><\/h2>\n
\r\n\u53ef\u64f4\u5c55\u6027\u6846\u67b6:\r\n\u251c\u2500\u2500 \u7db2\u8def\u64f4\u5c55\r\n\u2502 \u251c\u2500\u2500 IPv6\u5c31\u7dd2\r\n\u2502 \u2514\u2500\u2500 BGP\u4f4d\u5740\u7a7a\u9593\r\n\u251c\u2500\u2500 \u6548\u80fd\u64f4\u5c55\r\n\u2502 \u251c\u2500\u2500 \u591a\u8cc7\u6599\u4e2d\u5fc3\u6574\u5408\r\n\u2502 \u2514\u2500\u2500 CDN\u5be6\u65bd\r\n\u2514\u2500\u2500 \u76e3\u63a7\u64f4\u5c55\r\n \u251c\u2500\u2500 \u5206\u6563\u5f0f\u8ffd\u8e64\r\n \u2514\u2500\u2500 \u6307\u6a19\u805a\u5408\r\n<\/code><\/pre>\n