DDoS Protection & Logging

Objective

Ensure the zWAN/zGuardian device detects, mitigates, and logs common DDoS attacks (ICMP, UDP, TCP SYN, TCP RST floods, SSH brute force), maintaining service availability.

Prerequisites

• Admin access to zWAN Director UI.
• Device with DDoS enabled and interfaces configured for scanning.
• Test clients available on LAN (Linux and Windows).
• Authorized lab or POC environment for testing.

Test Setup and Configuration

1. Log in to zWAN Director UI.
2. Navigate to: Edge Controllers > [Device] > Security > DDoS
3. Enable the DDoS Protection toggle.
4. Click Add Interface, select WAN interface(s), enable scanning, and save.
5. Review and adjust threshold values for: ICMP Flood, UDP Flood, TCP SYN Flood, TCP RST Flood, SSH Brute Force.
6. Save and apply changes.

ICMP Flood Test

Linux:
Run these commands in your terminal:

• sudo apt-get install hping3
• sudo hping3 –icmp –flood –rand-source <target_ip>

Windows:
Using Nping (included with Nmap):

• nping –icmp –rate 1000 –dest-ip <target_ip>

Note: Adjust <target_ip> to your zWAN device WAN IP.

UDP Flood Test

Linux:

• sudo hping3 –udp –flood –rand-source -p 53 <target_ip>

Windows:

• nping –udp –rate 1000 –dest-ip <target_ip> -p 53

TCP SYN Flood Test

Linux:

• sudo hping3 –syn –flood –rand-source -p 80 <target_ip>

Windows:

• nping –tcp –flags syn –rate 1000 –dest-ip <target_ip> -p 80

TCP RST Flood Test

Linux:

• sudo hping3 –rst –flood –rand-source -p 80 <target_ip>

Windows:

• nping –tcp –flags rst –rate 1000 –dest-ip <target_ip> -p 80

SSH Brute Force Test

Linux (Hydra):

• sudo apt-get install hydra
• hydra -l testuser -P /usr/share/wordlists/rockyou.txt ssh://<target_ip>

Windows (Medusa):

• Download Medusa from https://github.com/jmk-foofus/medusa/releases
• Extract and open Command Prompt in Medusa folder.
• Run: medusa -h <target_ip> -u testuser -P rockyou.txt -M ssh

Validation

1. Check Edge Controllers > [Device] > Security > DDoS > Attack and Portscan tabs for blocked IPs.
2. Review Edge Controllers > [Device] > System > Logs > SYSLOG > DDoS tab for event details.
3. Verify other network services remain operational during tests.
4. Confirm attack traffic is blocked or rate-limited.

Safety and Legal Disclaimer

• Perform tests only in authorized lab or POC environments.
• Start tests at low rates and increase cautiously to avoid network impact.
• Notify stakeholders before running tests.
• Stop immediately if unintended disruption occurs.