Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network card interrupts. ksoftirqd goes to 100% and machine becomes almost unaccesible. How can I deal with these kind of attack - throwing huge number of random packets? Is there any way to somehow tweak handling server interrupts or distribute it over other CPUs?

My network card uses NAPI, linux kernel is

share|improve this question
maybe this helps… – Sandman4 Dec 12 '11 at 7:16
Thank you Sandman4. It looks promising! I will let you know if it works as soon as my hosting provider unlocks my machine :) – rfire Dec 12 '11 at 11:26
yeah, google rocks – Sandman4 Dec 12 '11 at 11:32

You need to contact your upstream provider and have them block, filter or otherwise prevent the packets from this DDOS from reaching you. There's really not much you can do by the time they arrive on your server.

You can try to block the source IP addresses using iptables, but likely the (computational) damage is already done by the time iptables actually looks at the packets and decides to drop it.


Your comment doesn't make sense to me. You have DDOS caused by lots of or specially crafted packets (or both) causing too much computational overhead due to interrupt switching. Are they coming from one or a few sources? Have your upstream provider drop packets from that source/s? Profit! If they never get to your machine - they'll never cause the problem in the first place. There's no magic you can do on the host to prevent this from happening once the packets already arrive. You need to have dropped the packets before they arrive on your machine. Contact your service provider or hosting company.

share|improve this answer
The attack is one level "deeper" what i mean is i could block the whole machine to only one IP Address but it would be still inaccessible since packets comes in and generates interrupts which still consumes CPU. – rfire Dec 11 '11 at 23:55
Please see my edit. – kce Dec 11 '11 at 23:58
No, unfortunately they comes from variety spoofed sources so it's impossible to block them by source IP. The packets are totally random, they only have one common thing - destination port. – rfire Dec 12 '11 at 0:03
Sorry, i misunderstood your post, of course i've been talking about blocking machine to only one IP Address but on the server-level. – rfire Dec 12 '11 at 0:12
I still have no idea what you're asking... what does "server-level" mean? Who controls your connection to the internet? Call them and ask them to drop traffic to your server's IP address and the specific destination port (provided that that port isn't used for other services you need). – kce Dec 12 '11 at 1:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.