Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

My server went down earlier - looks like a DDoS. A spike in traffic to around 13mbit, the swap goes from idle to maxed in about 5 minutes, and server stops responding.

I would like to protect against the attack but I can't determine the method. Server logs show no increased http connections or usage, nor mysql or mail usage above usual levels. Server graphs only show spikes in Network, I/O, and Memory Usage:

Memory Usage: IO Graph:

I can't fathom what type of attack this is. Where could this be targetting and how can I protect against it? All comments gratefully received.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:29

This question was marked as an exact duplicate of an existing question.

See what netstat -n says. – FINESEC Nov 7 '12 at 18:49
Request logging? Software and site technologies? Any details?? – Chris S Nov 7 '12 at 18:50

The spike in IO is likely your system trying to use all that swap. The first thing I would do is figure out what process is using all that swap. You may need to patch your ps in order to do this easily:

share|improve this answer
Thank you - that's useful for the future. If not httpd, mysql, or mail, what process could a DDos cause to fork? – monkeymatrix Nov 7 '12 at 21:38


If the DDoS came from a defined geographic region, ask your provider for blocking them.

share|improve this answer
SYN flooding seems like a possibility, but any way I can confirm? Obviously box is now rebooted so netstat isn't saying much, but box is running CentOS and Cpanel. – monkeymatrix Nov 7 '12 at 19:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.