Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Newroz Telecom (an ISP) is using an exit node (or gateway) for each city they operate in. That is all the users in city A is sharing one public IP (when the users go to a website to show their IP they all get the same result).

I am having DDOS attacks that is coming from a user/users of this ISP, blocking the IP will mean blocking the entire city, how can i fight DDOS in such environment ?

Best regards,

share|improve this question
Signing up for CloudFlare (or a similar service) might be a good option for you. – Ladadadada Jul 4 '13 at 18:30
up vote 1 down vote accepted

Here are a few options:

Can you TCPDump the traffic and maybe find a packet that is the ddos packet string and block it?

In all honesty, the only way this will probably be fixable is to ask the ISP to check and find the abuser.

share|improve this answer
The attack have stopped (for now) and i am out of the office so i cant run your request at the moment, but can you explain more about blocking the packet string ? What do you mean ? Wont that be just like blocking the public ip ? Or do you mean check the packets and drop the malicious ones ? – zertux Jul 4 '13 at 16:52
Packets contain TTL, Strings, and other information. You can use IPTables to block certain packets based on certain contents. This can work in situations the attackers packets are the same. – Tiffany Walker Jul 4 '13 at 20:57
I see, do you reommend any readings on this ? Books, tutorials ? – zertux Jul 4 '13 at 22:01
I would man TCPDump and look up TCPDump. – Tiffany Walker Jul 4 '13 at 22:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.