2

OK, so here's some info: Fedora23 running in VirtualBox on a Windows 7 Host.

Public-facing router has no DMZ, but port forwarding from 2325 (external) to 1194 (internal) and the internal static IP.

Running iftop, I'm getting a huge amount of incoming/outgoing traffic (50-70 mbps):

revolve-mainframe           => 104.23.119.177                    54.6Mb  35.4Mb  8.84Mb
                            <=                                      0b      0b      0b
revolve-mainframe           => v.pr.h.cpvps.us                      0b    643b    210b

This bogs down our office's internet, needless to say.

Running the following commands to block the IPs fixes the issue:

[root@revolve-mainframe sysconfig]# sudo route add -host 104.23.118.177 reject
[root@revolve-mainframe sysconfig]# sudo route add -host 104.23.119.177 reject
[root@revolve-mainframe sysconfig]# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         gateway         0.0.0.0         UG        0 0          0 enp0s8
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
104.23.118.177  -               255.255.255.255 !H        - -          - -
104.23.119.177  -               255.255.255.255 !H        - -          - -
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 enp0s8
192.168.56.0    0.0.0.0         255.255.255.0   U         0 0          0 enp0s3

Now the question is, is this a result of a DDoS attack? If I unblock those two IPs, I get a flood of incoming packets from all kinds of different IP addresses.

But it is only two specific IP addresses that I have to block to stop the flood.

Or is it that my server has been compromised and being used as a DDoS source?

Or...?

Improve this question
5
  • 4
    You are not being DDOSed. There are not enough connections being made. You cannot be DDOSed from a single ip address.
    – Ramhound
    Jul 19, 2016 at 23:58
  • 2
    That's correct @Ramhound, but you can be DoSed (without the second D) from a single IP address if the attack bandwidth exceeds the bandwidth available to your uplink.In OP's case however, the server is not receiving an attack. It is actively generating traffic towards the IP addresses indicated in iftop. ry to find out which process causes the traffic on your machine. Maybe it's just a faulty or a long forgotten cronjob.
    – markusju
    Jul 20, 2016 at 8:35
  • 1
    Right but the author thinks he is being DDOSed not DOSed. I know the difference, didn't make mention or explain the difference, on purpose
    – Ramhound
    Jul 20, 2016 at 11:10
  • OK I discovered a bit more information, data is indeed being sent to and from a multitude of IP addresses. As soon as I block a pair of IPs, another set pop up in the iftop list. Furthermore, if I look at the Windows network activity (I've a Windows 7 host with a Fedora 23 Guest in a VirtualBox VM using a bridged adapter for accessing the internet), I've sent WAY more than received. Appx 632 GB have been sent over the past day, while only 300 MB has been received. So now, it seems my server may have been compromised and is in fact being used as a DoS source.
    – heisian
    Jul 21, 2016 at 5:04
  • I've disabled the network service via systemctl on the Fedora VM for now. I think what I will do to be sure is to just re-build the stack in the cloud.. EC2. That way, fresh install, and ability to get fresh IPs on a whim.
    – heisian
    Jul 21, 2016 at 5:07

1 Answer 1

Reset to default
0

I currently see two possibilities,

1) Our office's IP address (static IP provisioned by the lovely Comcast) is on a list of known targets by some DDoS/DoS attacker.

2) Server has been compromised and is being used to DoS attack others.

Or both.

Either way, what I'll do to remedy this for now is completely re-build the server stack from a bare instance on Amazon EC2. If my physical server at our office has been compromised, then the new cloud stack will solve that.

Running a cloud instance will also allow me to get a fresh static IP rather trivially, that of which would be a customer service nightmare with Comcast were I to want to do the same for our office's own WAN static IP.

Taking it one step further I could assign a domain name to my cloud-provisioned IP and use a service like Cloudflare to mask and thwart DDoS attempts, should I want to for some reason make public an address for my cloud server. But being that out of 4 public-facing Amazon EC2 servers, none have yet been the victim of attack, that may not even be necessary (until our company becomes a bigger target that is).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .