Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I have a non-Xen VPS (don't exactly know what the software is).

The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, the whole server has been suspended because of the reason.

I use DIrectAdmin.

Is there an automated tool to detect DDOS attacks and suspend the host when special number of attacks are occur?

I don't want a tool more than just monitoring (I've found MRTG for that purpose and will install it as soon as the server was unsuspended)

Please advice me with the best solution.

share|improve this question

marked as duplicate by Falcon Momot, mdpc, Jacob, Ward, Jenny D Jun 26 '13 at 12:41

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

The first thing you should do is gather proper information about the attack, whether DDOS or otherwise. While it is possible that you are the target of this attack, it is equally likely that your own system is the origin of these attacks - especially if you are running any mass-distribution CMS system. (You did say you use DirectAdmin...)

You can record about a day's worth of traffic with something like this:

tcpdump -w file -G 60 -W 1440 -s0 -p -C 5

That should tell you whether you need to write your own automated harakiri script. Understandably, since it is a rather desperate measure, you won't find one.

If you are the source of the DDOS, then, well, you can't expect much sympathy from your host - find out what is running on your system and kill it.

If you are the target of the DDOS, then you may be able to respond (or not respond) appropriately in a way that stops the flow of traffic. If you are already not responding, then the only thing you can do is hide away in your shell ... you could try this if you think your adversary will go away in 10 minutes:

screen # don't stay dead on shell hang-up
/etc/init.d/networking stop; sleep 600 ; /etc/init.d/networking start

If you have multiple IP addresses, then taking down just the targeted IP address should do the trick.

Your provider may be able to do something about tracing the source of the attacks, but don't hold your breath.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.