This question already has an answer here:
- I am under DDoS. What can I do? 2 answers
Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS.
Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec).
In the Nginx access log, I noticed a POST request to a 499 error coming from 10-15 unique IPs very repeatedly to a support ticket system with have installed (/support/index.php - running OSTicket). I blocked INPUT/OUTPUT on these IPs in iptables. I don't think this did anything but it was odd none-the-less considering these IPs were repeating the POST request ever few seconds.
How can I pinpoint the problematic IPs and block them from sending massive incoming requests?
EDIT: Here is a printout of iptables -L -v http://pastebin.com/cyGLKJh4