Detect bad outgoind trafic KVM

[naturlight]

Hello everybody,
There is 2-3 days an User on KVM did DDOS attack ..
I would you like to know if it's possible to block this , to disable or minimize a bad user.

I think about this :
If an user do more than x SYN_ACK then qm suspend the vmid or iptables ban the ip on UDP , ICMP ..
What i'm doing :
A script to protect the outgoing trafic if anybody want to contribue ..

 

[naturlight]

At this time i created a script wich allow 1000 UDP outgoing packets / client bridge and 3 icmp requets outgoing /sec for each client bridge .
Now i would like limit the bandwidth outgoing on UDP at 5Mbps .. what can i use ?
I look for Dummynet is seems good but not stable under debian
http://info.iet.unipi.it/~luigi/dummynet/
How many iptables rules can support the server ? Any idea ?

 

[snowman66]

Try OSSEC. It's host based intrusion detection system and it works on linux and windows.