Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

My VPS is under a DDoS attack. I cannot access RDP, and I cannot take it offline, or access it in any way at all. What can I do?

They are not trying to bruteforce, just trying to stop access to the VPS. I don't know if maybe the datacenter messed up or something, but the VPS is online and denying all requests as is normal when under DDoS.

Is there anything that I or my dedicated hosting provider can look at in the logs? How should I approach forensics after the fact?

I don't know much about DDoS attacks, do they usually stop after a few days?

Is there an existing anti-ddos program or something?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
How do you come to the conclusion it is a ddos? –  Posipiet Dec 26 '09 at 20:35
    
The VPS is online but not responding to anything –  Cyclone Dec 26 '09 at 20:46
1  
How do you know that it's online if it doesn't answer to anything? –  ℝaphink Dec 26 '09 at 22:03
11  
Windows XP (a workstation OS) being online but frozen when being used as a server doesn't say DDoS to me, it says Windows screwing up because it's not designed for what you're using it for. –  Dentrasi Dec 26 '09 at 22:16

4 Answers 4

up vote 12 down vote accepted

There is no easy way to stop DDoS attacks. Get in touch with your provider and ask them for help. No program will help you against a DDoS which is intended to consume your bandwidth, you can only absorb these attacks by having more capacity and working with your upstream providers to dismantle the attack.

share|improve this answer
    
They stopped the attack. –  Cyclone Dec 27 '09 at 2:25

Open a ticket with your hosting company. Hopefully, they can put up a block upstream.

share|improve this answer
    
Would even just shutting down the vps work? If there is nothing to ping, itd be like stabbing a sword at empty space. –  Cyclone Dec 26 '09 at 20:17
1  
Considering that, as the name suggests, DDoS is used to 'Deny Service', shutting down the machine means it has been completely DDoS'd, so you could argue it doesn't help. It depends on the type of the DDoS though.. –  Dentrasi Dec 26 '09 at 22:18

In my days in the hosting industry, its very rare that the attack happened because of the legitimate content of the site. It usually because the account has been compromised and used to host bots, copyrighted-infringing material or other potentially illegal files/scripts.

Assuming that you do get back in, you'll have to audit the web applications on your server and make sure that the appropriate updates were applied or taken offline Your ISP may be able to assist you in determining what invited the DDOS (likely at a nominal cost). Hopefully, the server is not rooted - if that happens, it may have to be re-imaged.

share|improve this answer

Compared to hard- or software failure, DDoS is a rare occurence. Your system just being unreachable is no proof whatsoever.

If your system were under a good solid DDoS, you wouldnt be able to reach it at all. No ping, no nothing, and the dedicated server would be off too, perhaps along with the entire datacenter. Just "RDP not responding" probably is a sign of a DDoS not happening.

Try getting the VPS rebooted. Check if the host is alive and well. Check network, duplicate IPs, gateways, firewalls, updates, etc.

Is a VPS within the EULA of the host? Perhaps the provider interferes with the NAT or bridging?

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.