Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

My server has been timing out and crashing lately.

I ran this command:

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Check the picture for result. Does the two IPs in the end ddos me? And how do I block them with IPtables?enter image description here

Thanks.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

2 Answers

Given the astoundingly large number of connections, it's possible that the host 75.67.41.234 and maybe 71.232.145.129 may be DoSing you with a SYN flood (or they may just be scraping your website with an extremely ineffective bot or something). A sample of the traffic could confirm this.

To protect against this type of DDoS (and not against a flood, which you cannot protect against with local rules and need your ISP's help to deal with), you can set up firewall rules with iptables to limit the number of connections a single host can open to you at once. This is an example of such a rule:

iptables -t filter -A INPUT -i $WAN_IF -p tcp -syn -m connlimit --connlimit-above 10 -j DROP

You can use a different target (-j REJECT for instance) to perform different actions, and you can set a different connection limit than 10.

share|improve this answer
add comment

The following is a good tutorial for preventing DOS attack using IPTABLES.

http://bipinkdas.blogspot.com/2008/09/prevent-dos-attack-in-linux.html

Regards

share|improve this answer
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Falcon Momot Jun 26 '13 at 1:15
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.