This question already has an answer here:
- How do I deal with a compromised server? 13 answers
I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host.
Amazon mail content attached for your reference.
Denial of Service attacks against remote hosts on the Internet; check the information provided below by the abuse reporter.
2012-02-23 00:31:38.218128 IP (tos 0x0, ttl 64, id 5911, offset 0, flags [DF], proto: UDP (17), length: 78) IP_addres.33840 > 220.127.116.11.0: UDP, length 50 2012-02-23 00:31:38.218146 IP (tos 0x0, ttl 64, id 5912, offset 0, flags [DF], proto: UDP (17), length: 78) IP_address.33840 > 18.104.22.168.0: UDP, length 50
my client informed me to block port 17 in iptables. we Blocked by using iptables command:-
sudo iptables -A OUTPUT -p udp --dport 17 -j DROP.
After the UDP port blocked in 17. still the DOS attacks continued.
finally we fetch the DOS attack log by command :
sudo tcpdump -nnvv -i any 'udp[tcp-syn] & (tcp-syn)' != 0 and not port 22
I need to clarify whether from AMAZON log values "proto: UDP (17)" means UDP port 17. If yes means once we blocked the outbound port. How the attack continues?
Otherwise, We need to make additional measures or test.
Kindly anyone provide solution to stop this DOS attacks