This question already has an answer here:
- I am under DDoS. What can I do? 3 answers
I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down.
I logged into the Hyper-V box and noticed everything was super slow. I opened task manager and saw that while CPU and RAM were fine, network utilization on our "Public" NIC was at 99%.
This lasted for about 10 minutes, during which time I found that disabling inbound connections for one of the servers caused the network saturation to drop to normal levels. I disabled that server's inbound connections to allow the other servers to operate, and eventually the traffic went away.
I suspect this was a DDOS or regular Denial of Service attack, but it seems pretty random. The server in question is very low visibility and not a lot of value would come from someone taking it down.
What would be the best way to tell if I am experiencing a DDOS attack? Is there anything else that you could think of that would cause this, and, if so, what should I look for?
EDIT: This happened again. I tried netstat -noa but didn't see anything useful. I was hoping there was some command or program I could run that would show me how much bandwidth each IP is using (i.e., it says network utilization is 100%, but how does that add up). Does anything like that exist?