Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

My server is under DDoS attacks. I see my access log and get something:

 968966 - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.        1)"
 968967 - - [27/Jul/2011:12:13:39 +0700] "GET /forum/forum.php HTTP/1.0" 200 91539 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968968 - - [27/Jul/2011:12:13:38 +0700] "GET /forum/forum.php HTTP/1.1" 200 91228 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968969 - - [27/Jul/2011:12:13:39 +0700] "GET /forum/forum.php HTTP/1.1" 200 91228 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968970 - - [27/Jul/2011:12:13:39 +0700] "GET /forum/forum.php HTTP/1.0" 200 91539 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968971 - - [27/Jul/2011:12:13:39 +0700] "GET /forum/forum.php HTTP/1.0" 200 91539 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968972 - - [27/Jul/2011:12:13:35 +0700] "GET /forum/forum.php HTTP/1.0" 200 91539 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968973 - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91542 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968974 ::1 - - [27/Jul/2011:12:14:03 +0700] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
 968975 - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 968976 ::1 - - [27/Jul/2011:12:14:03 +0700] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)" 

I don't have any experiences about DDoS, please help me find and resolve issue? :( My server is CentOs 5.4 Apache 2.2 and PHP 5.2.6.


share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 9:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

do you have the resources to place a hardware firewall in front of the server? – SpacemanSpiff Jul 27 '11 at 5:44
No, I didn't used hardware firewall. – Tuan Ngo Jul 27 '11 at 6:38

A DDOS is a tough thing. By the time it's reached your server, or your network, it's already too late. Call your ISP. They're the proper ones to deal with a DDOS attack. Give them as much information as possible so they can find a pattern and block it.

share|improve this answer

As Jason already pointed out, your best current option is to call your ISP/Hoster for help.

After that, sign up for a CDN, if possible - they thwart most DDoS'es by design, or at least, make them only a localized nuisance. There are many CDN's which provide some free plan, which might be sufficient for you. I heard good stuff about CloudFlare, and used it a bit at some point. YMMV.

share|improve this answer

Theoretically, u can use Client Puzzle to solve DDos attack. Depend on the situation, you may use different kind of puzzle to solve your problems.

[May I know, how do you know if you are under DDos attack from above log?]

share|improve this answer
I use this command: watch "netstat -an | grep ':80' | awk '{print \$5}' | sed s/'::ffff:'// | cut -d\":\" -f1 | sort | uniq -c" and found a lot of requests from each IP in my access-log. So I think my server attacked by DDoS. – Tuan Ngo Jul 27 '11 at 6:47
CPP won't help you if the traffic is saturating your upstream links. The only thing you can do is work with your provider to blackhole the traffic. – Tom O'Connor Jul 27 '11 at 7:37
Without the additional double-quotes, the command by Tuan is as: netstat -an | grep ':80' | awk '{print $5}' | sed s/'::ffff:'// | cut -d":" -f1 | sort | uniq -c – siliconpi Jan 13 at 7:57

For a quick fix if you are aware of active DDOS
The page/site/portal where you are being DDOSed in the index.php pnly (or however you are handling the code flow in case of mvc) you can restrict the hacker's IP and return him true or false. and prevent him from hampering your Database.
As avoiding abusive traffic and returning a sorry page would always be a better way than letting them impact the database.

share|improve this answer
You unfortunately seem to have a fundamental misunderstanding of a DDoS: good Luck trying to block those thousands of IPs. Also, there is the same issue present with a CPP: upstream bandwidth. – Roman Jul 3 '13 at 13:10
100% agree in case if there are thousands of the IPs which are targeting. But as the log posted shows me few I suggested the quick fix of blocking those which are actively attacking (which was happening in my own case).<br> Also in case if they are many and are targeting one portal and and which ultimately is hitting the database i am using for multiple clients, I'd prefer to block/take down one portal for a while. Any wise suggestion to clear my fundamental misunderstanding will be a great help. – ILLUSION Jul 3 '13 at 15:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.