Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting anything


share|improve this question

migrated from Mar 21 '12 at 12:38

This question came from our site for professional and enthusiast programmers.

What kind of application would you want to protect from DOS? It's quite different if you want to protect a web server from DOS or a Linux mainframe from users using too many resources. – Antoine Mar 20 '12 at 16:43
This is a Linux web server, not a mainframe. I'm not getting any DoS, but just want to make sure i have suitable methods in place. – zizther Mar 22 '12 at 9:05

The by far greatest number of DOS attacks is distributed. A singular DOS attack (e.g. someone running a network load analyzer on his computer over night) can be thwarted by having a low-overhead service and consuming attacker time, for example by delaying responses. Banning an IP address (temporarily!) when too many requests are sent works too, there exist automated tools (e.g. fail2ban) for that.

All that doesn't work for a distributed DOS attack.

The best way to stop a distributed DOS attack is not being the target of one. Most owners of a server will eventually witness or be directly or indirectly be affected by a DOS attack, this just happens. Many of these are only half-assed too (or fully blown, but directed at someone else), and you just wait until it's over, with slightly impaired service.
However, most regular victims of serious DOS attacks had it coming in some way. When you're regularly the target of DDOS attacks, you need to reconsider your public relations.

The second best way is to configure a router high up on the hierarchy (the one that connects the datacenter to the backbone) to drop packets going to the attacked machine. A firewall on the attacked machine or close to it is useless.

All other means are useless as well, because no matter what you do, if someone uses 20 or 30 machines (or 200...) and just physically saturates the wire, there's nothing you can do against it from a software point of view.

There exist some pretty solutions like for example SYN cookies, which can in theory still allow a reduced-quality service in spite of DOS attacks, but these can't help the fact that while the wire is busy, no frames go through. So, given a massive enough attack, your ethernet card never receives any of your packets.

share|improve this answer
"configure a router high up on the hierarchy ... to drop packets going to the attacked machine" Yes, this is called DoS. – Niklas B. Mar 20 '12 at 17:08
"When you're regularly the target of DDOS attacks, you need to reconsider your public relations" That's the long and short of it. – Xeoncross Mar 20 '12 at 17:23
@NiklasB.: Well, of course that's DoS defined, but blocking the packets before they enter the datacenter is the only thing that works. Anything beyond that point is kind of futile. Of course this means that no legitimate packets get to your server either, but you can switch to a fallback address for that. The bigger problem is that as a "normal guy" who maybe owns 3 or 4 servers, you won't normally have access to a router that high up in the hierarchy. – Damon Mar 20 '12 at 23:52
When blocking by IP address, bear in mind that the attacker may know you will do this, and in fact the purpose of the attack is to deny your service to the other people who need to use the same proxy. – James Youngman Mar 22 '12 at 0:46
Thanks guys. I'm not getting a DoS attack, i just wanted to make sure i have methods in place that could make sure if someone wanted to attack the service would not freeze. Also i am not talking about protecting myself against what it takes to take down Facebook or Google. – zizther Mar 22 '12 at 9:08

Preventing DOS attacks is more like an art and a work in progress than a simple goto solution. The best way is to start small using common tools, analyze logs and work your way from there.

May I suggest to look at this to get a basic protection up and running:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.