Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last?

Just trying to get an idea of how long we'll have to continue to wage this battle (going on a couple weeks now).

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6 Answers 6

up vote 5 down vote accepted

The short answer is, "until it stops".

Afaik, there aren't any good statistics on averages, and intensities - most attacks go unreported publicly. As many have already mentioned your best, and probably only, bet is to have a candid discussion with your ISP, and rely on their knowledge and experience.

Typically, depending on the tools available and skills of the administrators, you'll be offered with various tradeoffs between site accessibility to the outside world and effectiveness at filtering the DDoS, which will tend to work well enough.

If this sort of attack happens to you frequently, or goes on for more than a few days, it may be worth investing in a better equipped ISP, or, if you're high enough upstream to be responsible for your own DDoS protection, investing into better security tools and people.

share|improve this answer

Anywhere from a couple of minutes to a pretty much constant and neverending stream of junk. The mean and median would both be in the "days" range, though often it'll run for a day or two, go away for a few days, then come back again (usually slightly different and more damaging).

share|improve this answer

Once I had a rather innovative incident in which conduit's toolbar was used to do a ddos on one of my websites. The toolbar designer had thousands of his user constantly ping my website. It went on for more than a month.

share|improve this answer
    
Funny thing happened me once. I had one colo customer dos another colo customer, 100mbit worth of traffic from one rack to the neighbouring rack. hehe :D for once it was pretty easy to get a hold of the perp.. :] –  Rune Nilssen Dec 30 '09 at 7:51

Until you can setup a system which will mitigate the attack, or when the attacker's demands are met, if there are any, but if there aren't any it will take until he gets bored.

share|improve this answer
1  
Bad attitude. Of course there are things that can be done and generally they're not handled be the person being targetted. If your upstream provider can't mitigate a DDoS attack, it's time to find a new provider. –  rodjek Dec 30 '09 at 13:03
    
I doubt meeting the attackers demands is a good idea, people who do this are unlikely to stop once you have shown a willingness to pay their price. –  Tony Edgecombe Jan 19 '10 at 7:00

as mentioned above a Ddos attack varies in its length of time, normally it should not be that much of a problem if your hosting company / ISP can put measures in place to filter the traffic and block a majority of it.

at the start of last year our company encountered problems from a ddos attack which lasted 2.5 days more or less, it was a low amount of traffic but enough to slow our services at first. our ISP reacted immediately when it was reported to them and they filtered traffic to negate any impact it may of been having. the block remained in place for 2 days when they then reported the traffic had stopped.

share|improve this answer

We have had one going on for 2 weeks now and no sign of it slowing down - i guess they last as long as the attacker has the resources to continue. The crucial thing is to get as much filtering protection as you can with your hosts. If they are any good they will get on top of it for you although as pointed out by Joe above, it's not free. We are amazed in the UK, there's no single body you can go to to report an attack to or get any kind of investigation going.... i guess the authorities are way behind on this. Having talked to our hosts they say it's definitely a growing trend (most go unreported) so it's best to be prepared.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.