Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second.
Is there a way to defend this kind of attack?
Is there a way to trace back to the attacker?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You can traceback to the C&C if you've got a ridiculous amount of time and resources, but in practice you'll not have a lot of luck unless you've got a lot of knowledge and experience.

To defend against this sort of attack, you can try to identify some common aspect of the attack (user-agent, for instance) and block them before they get into the high-resource-usage parts of the site (assuming that they're killing the site by requesting a dynamic page that takes significant time to process). You can also increase your performance in general to handle the load (caching, optimisation, buy more hardware), but that's an arms race you probably can't win.

Finally, if you just want the problem to go away, get out your chequebook and head to a DDoS mitigation specialist like Arbor networks. They're not cheap, but they do tend to make the problem go away, and it's cheaper than your site dying a slow and painful death while you learn the hard yards of DDoS mitigation yourself.

share|improve this answer
add comment

You can try using either SYN Cookies or WEB Cookies for verifying sources trying to access your website.

Though SYN Cookies is pretty simple and straight forward, it is surprising to see how many attack tools cannot answer them properly. Apache, for example, support SYN Cookies itself (/proc/sys/net/ipv4/tcp_syncookies).

WEB Cookies are more sophisticated, and can be done with simple 302 redirection to the same location with a cookie for verification of authenticity, or with more complex mechanism of a JS object. I do not know if these options are supported on regular web-servers. Though I was told there is a Russian web-server that can run both.

And of course, as womble mentioned above, you can either 'rent' DDoS server from MSSPs, either your own provider or from 'in-the-cloud' services, or get your own dedicated Anti-DoS equipment. There are many, at different ranges of prices. There are Pros and Cons for either solution/product.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.