Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

My server went down earlier - looks like a DDoS. A spike in traffic to around 13mbit, the swap goes from idle to maxed in about 5 minutes, and server stops responding.

I would like to protect against the attack but I can't determine the method. Server logs show no increased http connections or usage, nor mysql or mail usage above usual levels. Server graphs only show spikes in Network, I/O, and Memory Usage:

Memory Usage: http://i.imgur.com/UwGru.gif IO Graph: http://i.imgur.com/DVECD.gif

I can't fathom what type of attack this is. Where could this be targetting and how can I protect against it? All comments gratefully received.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
See what netstat -n says. –  FINESEC Nov 7 '12 at 18:49
    
Request logging? Software and site technologies? Any details?? –  Chris S Nov 7 '12 at 18:50

2 Answers 2

The spike in IO is likely your system trying to use all that swap. The first thing I would do is figure out what process is using all that swap. You may need to patch your ps in order to do this easily: http://r0bertz.blogspot.com/2010/04/show-real-swap-usage-for-each.html

share|improve this answer
    
Thank you - that's useful for the future. If not httpd, mysql, or mail, what process could a DDos cause to fork? –  monkeymatrix Nov 7 '12 at 21:38

SYN-Flodding?

If the DDoS came from a defined geographic region, ask your provider for blocking them.

share|improve this answer
    
SYN flooding seems like a possibility, but any way I can confirm? Obviously box is now rebooted so netstat isn't saying much, but box is running CentOS and Cpanel. –  monkeymatrix Nov 7 '12 at 19:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.