Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I log UDP flood DDOS attacks?

Right now I am thinking about detecting if the server is receiving more than X megabytes per second for Y seconds, and then doing trafshow > logs.txt as root (since trafshow requires root).

Is there a better solution?

share|improve this question

closed as off-topic by Tom O'Connor Aug 25 '13 at 21:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Tom O'Connor
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

Depends - do you have access to metrics on the networking gear?

Generally speaking, I'd say that monitoring and alerting on network traffic should be handled by whatever's doing monitoring and alerting for the network devices.

If it's a situation where you don't have access to that data, then maybe look at having the server produce a NetFlow feed for monitoring purposes.

share|improve this answer
    
No I don't have access. I am renting a server. My host says they can't log DDoS attack IPs unless it is currently happening. –  Bob Mar 17 '12 at 5:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.