up vote 4 down vote favorite
share [g+] share [fb]

I have been under constant DDOS attack the last couple of weeks.

Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages.

I run CENTOS 5.6, and i have hardened SYSCTL and iptables to fight off SYN attacks as much as possible.

I have a 100Mbit network card and connection to my hosting company.

Normal incoming traffic is around 8mbit/s. Incoming data spikes go up to 100mbit when the attacks happen.

Could it help me fight off attacks if i were to upgrade my server to a 1GBPS network card + network connection?

I'm hoping the pipe doesn't flood so quickly when it's under attack.

link|improve this question
73% accept rate
8  
Any idea why you're getting DDoSed? Who've you pissed off? – Tom O'Connor Aug 8 '11 at 15:25
No idea, i wish I did. – FunkyChicken Aug 8 '11 at 19:18
If you upgrade your network connection will the rest of your system be able to cope with the additional load? – John Gardeniers Aug 10 '11 at 5:19
feedback

4 Answers

up vote 12 down vote accepted

You should be working with your hosting company to mitigate the attack.

They likely have other resources and means with which to deal with a DDOS attack. It is better handled at the network edge rather than the target.

link|improve this answer
Yes, I agree. But the DDOS attacks I am receiving only last about 1 - 5 minutes. By the time my hoster has received my request, the attack is usually over already. But I'm getting 15 - 20 a day of these attacks. Furthermore, my hoster can only offer me their Cisco Guard. Which fights off the attack, but also blocks many 'normal' visitors. So I'm looking to improve my server/network in other ways. All tips / ideas are more than welcome! – FunkyChicken Aug 8 '11 at 15:08
Well, upgrading to Gb will help you mitigate the attacks if the actual attack bandwidth is <1Gb. It may not be the best thing to do as it may end up costing you more $$$ than you expect due to using up your bandwidth at a higher rate. A service such as CloudFlare (mentioned below) may help. I haven't tried them myself but the idea is a good one. – MikeyB Aug 8 '11 at 15:20
You can also spend a lot of money and go with something like Arbor Networks' PeakFlow: arbornetworks.com/threat-management-system-ddos-mitigation.html – voretaq7♦ Aug 8 '11 at 15:29
@Godius, so if they come in waves that makes them easy to spot and compare against background traffic and identify unique elements in the attack (e.g. which pages, user agent, etc). It also means you have a chance to compare before/after effects of your evasive actions. Plus if they are only 1-5 minutes in length it would be feasible to tcpdump all traffic during this period and analyse it offline. You might not realize it, but you're in a power position to counter the attack :) – Coops Aug 8 '11 at 15:56
3  
@Godius, P.S. if your hosting provider is happily letting you upgrade to 1GB pipe I would start considering moving to a more proactive hosting provide. – Coops Aug 8 '11 at 15:59
show 1 more comment
feedback
up vote 5 down vote

Umm... No. Having a bigger pipe doesn't do anything to prevent the traffic or the attack. You may reduce the impact, but you're not fixing anything by installing a 1Gbps NIC.

link|improve this answer
feedback
up vote 4 down vote

A solution to this is CloudFlare. It acts as a reverse proxy for your site and blocks DDoS attacks. It can also perform security checks and reputation checking for the IPs trying to access your site.

link|improve this answer
+1 Used this recently. It has some usability flaws, but I'd be looking to try this before paying for a gigabit pipe! – Coops Aug 8 '11 at 15:52
feedback
up vote -4 down vote

You should be able to identify the IP's of the attacking sites. Your hosting company should then be able to block those sites. It should not affect normal client operations.

link|improve this answer
2  
If this truly is a DDoS, it isn't possible to effectively isolate this kind of thing. It comes from many sources. – Brad Aug 8 '11 at 15:42
1  
As Brad says, the first "D" in DDoS means simply blocking a list of IPs is normally of little effect. – Coops Aug 8 '11 at 15:53
Just imagine an attack coming from say 10 million separate IP addresses. By the time they're blocked they will have been replaced by a whole bunch of new ones. – John Gardeniers Aug 10 '11 at 5:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.