Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Am having some form of brute force attack being done to my server and I have a screenshot of what's happening below. Remote Address is somehow abusing all of my ports and burning through my bandwidth at an incredible rate.

Does anyone know how to directly combat this problem even if I were to not know the IP address as I do now?

I tried blocking the address via iptables like:

iptables -A OUTPUT -s -j DROP

but the it still continues. Maybe I'm missing something but I'm pretty desperate because I can't afford to pay the bandwidth overage charges at this rate.

Server Attack

Bandwidth Burnage

EDIT Blocked all output destination port 53 traffic iptables -I INPUT 0 --dport 53 -j DROP as I use cloudflare and don't need to resolve my own DNS. I'm seeing some weird things in iptraf still

Multiple Attackers

The amount of traffic has drastically reduced but I'm still getting a solid amount and there's source/destination IP addresses still coming in that are not my ip address. I'm completely baffled as to why they're even showing up because none of them are

Reduced Traffic

share|improve this question
You are being used to denial-of-service someone. – ceejayoz Jun 30 '14 at 20:19
See "What can I do?" at – ceejayoz Jun 30 '14 at 20:20
Your server is the attacker, not the victim here. This indicates that you have been pretty thoroughly compromised. Time to nuke it from orbit. – Michael Hampton Jun 30 '14 at 20:37
@MichaelHampton A DNS amplification attack requires no compromise, just an open resolver. – ceejayoz Jun 30 '14 at 20:37
@MariusMiliunas You need to stop running an open DNS resolver. – ceejayoz Jun 30 '14 at 20:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.