Мой Auth.log становится очень тяжелым (80 ГБ на файл) из-за постоянных записей, поступающих с множества разных IP-адресов.
Jun 20 14:00:36 localhost pluto[1796]: packet from 180.30.141.75:20532: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 217.7.68.178:33733: not enough room in input packet for ISAKMP Message (remain=26, sd->size=28)
Jun 20 14:00:36 localhost pluto[1796]: packet from 217.7.68.178:33733: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 217.7.68.178:33733: next payload type of ISAKMP Message has an unknown value: 76 (0x4c)
Jun 20 14:00:36 localhost pluto[1796]: packet from 217.7.68.178:33733: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 61.8.76.134:27325: not enough room in input packet for ISAKMP Message (remain=26, sd->size=28)
Jun 20 14:00:36 localhost pluto[1796]: packet from 61.8.76.134:27325: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 103.21.206.53:27430: not enough room in input packet for ISAKMP Message (remain=26, sd->size=28)
Jun 20 14:00:36 localhost pluto[1796]: packet from 103.21.206.53:27430: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 183.108.222.31:40693: not enough room in input packet for ISAKMP Message (remain=26, sd->size=28)
Jun 20 14:00:36 localhost pluto[1796]: packet from 183.108.222.31:40693: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 219.85.139.163:43305: not enough room in input packet for ISAKMP Message (remain=26, sd->size=28)
Jun 20 14:00:36 localhost pluto[1796]: packet from 219.85.139.163:43305: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 61.8.76.134:45894: next payload type of ISAKMP Message has an unknown value: 30 (0x1e)
Jun 20 14:00:36 localhost pluto[1796]: packet from 61.8.76.134:45894: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 219.85.139.163:43305: next payload type of ISAKMP Message has an unknown value: 126 (0x7e)
Jun 20 14:00:36 localhost pluto[1796]: packet from 219.85.139.163:43305: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 124.80.133.178:49554: not enough room in input packet for ISAKMP Message (remain=26, sd->size=28)
Jun 20 14:00:36 localhost pluto[1796]: packet from 124.80.133.178:49554: Received packet with mangled IKE header - dropped
Jun 20 14:00:36 localhost pluto[1796]: packet from 124.80.133.178:49554: exchange type of ISAKMP Message has an unknown value: 45 (0x2d)
Jun 20 14:00:36 localhost pluto[1796]: packet from 124.80.133.178:49554: Received packet with mangled IKE header - dropped
Я не могу сказать, подвергаюсь ли я DDOS или нет, и если да, то каким образом я могу защитить себя.
Это весь трафик, связанный с IPSec. Вы используете IPSec? В противном случае просто установите соответствующий ограничительный брандмауэр для входящего трафика, и журналы остановятся. Если вы используете IPSec, то, возможно, создайте белый список брандмауэра, ограничивающий подключения к IP-адресам, с которых вы знаете, что вам нужно будет принимать трафик.