Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down to the product, user information and payment and I want to avoid captchas.

share|improve this question
add comment

migrated from stackoverflow.com Aug 31 '09 at 17:43

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6 Answers

up vote 5 down vote accepted

None of those will really protect from DDoS attacks. The point of a DDoS is to use up so much of the targets bandwidth that no legitimate traffic can get through.

Having a captcha or something will protect from bots, but thats about it.

The only way to mitigate (but not solve) the risk of DDoS attacks is to get more bandwidth and failover agreements with other hosting providers.

share|improve this answer
    
But don't DDoS attacks use zombie computers to run bot scripts? –  gAMBOOKa Aug 31 '09 at 17:34
    
Some do. A simple DDoS is to find out what server your site is on and simply flood it with page requests. That is essentially what is happening when a site gets slash-dotted. –  EBGreen Aug 31 '09 at 17:37
2  
@gAMBOOKa: Yes, typically. Can your captcha code handle millions of requests a second? Can your hosting provider? –  Michael Petrotta Aug 31 '09 at 17:38
add comment

There is nothing to prevent DDoS attacks, there is no single tool to mitigate them, you can only raise the bar, having a good firewall and some thresholds (automatic rejects, even banning) for accessing the different services/pages if you know the average use of the site

share|improve this answer
    
I'm curious: How would a firewall (good or bad) be helpful if the pipe is just full? –  Server Horror Jun 5 '11 at 21:54
add comment

Squid can help with slashdotting. It will help your system handle large volumes of identical requests without pounding the hardware so hard. http://en.wikipedia.org/wiki/Squid%5F%28software)

share|improve this answer
add comment

This guy has a way to help with application code. Not sure if it works for your language of choice, but the idea is good. Nothing is capable of stopping all attacks, but you can try to make it difficult for them =)

share|improve this answer
add comment

You can install mod_evasive if you are using Apache - a short description can be found here: http://www.think-security.com/protect-your-apache-web-server-with-mod_evasive/

share|improve this answer
add comment

A good relationship with your bandwidth provider is about the only thing that can help you mitigate a DDoS attack. The reason being that once the traffic hits your wire, it is effectively taking up bandwidth, so there's nothing you can put on your side that will help. Being able to work with your ISP to filter out DDoS traffic before it comes down the wire at you is both the only way to keep the traffic off of your circuit as well as the best way to escalate the issue (the ISP will likely try to filter the traffic coming into their network as well). Your ISP will be considerably more effective if other ISPs need to be contacted to shut down bot hosts...

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.