0
votes
3answers
979 views

iptables rule to stop DDOS [duplicate]

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
0
votes
1answer
735 views

TCP DOS: How to terminate CLOSE_WAIT connections? [duplicate]

One of my servers is getting DOS'ed - there are a large number of connections in the CLOSE_WAIT state which are preventing legitimate users from connecting to the system. So is there any way to close ...
0
votes
2answers
2k views

Protection against Ddos Syn Flood [duplicate]

My dedicated server can't handle more than 4Mbits/s of bandwidth. After that, the server don't ping anymore. My provider told me it's because my server isn't well configured. When I look in the logs (...
1
vote
1answer
909 views

Multiple DDOS attacks per day [duplicate]

I run a popular tech website, and for weeks my site has been under DDOS attacks. The attacks happen at random times, and often about 10 times per day. Usually the attacks only last a few minutes, then ...
0
votes
1answer
1k views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
2answers
872 views

IP Address filter 'before' http secured connections for protection against DDoS attacks? [duplicate]

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an ...
4
votes
2answers
149 views

Will MX records with a longer TTL help mitigate effects of DoS attack? [duplicate]

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info page),...
1
vote
1answer
1k views

Server currently under DDOS, not sure what to do [duplicate]

My web server is currently under a DDOS attack I believe, the messages log is full of these kind of messages: May 13 15:51:19 kernel: nf_conntrack: table full, dropping packet. May 13 15:51:19 ...
0
votes
4answers
1k views

Getting a lot of hits on my web server and it's taking down my httpd. Possible DDoS? [duplicate]

I'm getting a lot of hits on my server. This server normally gets little to no traffic yet there's is constant hits every time I bring the server back up. I get the following error first ...
1
vote
1answer
443 views

Is mod_evasive the best prevention to DDOS attack [duplicate]

I already have IPTables blocking all unnecessary traffic. Is mod_evasive the best solution for something like this? What do you use on your server?
0
votes
2answers
731 views

Prevent scanning of the Apache's /default directory [duplicate]

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is constantly,...
3
votes
1answer
549 views

Stopping SYN DDoS Attack [duplicate]

One of my servers is under constant SYN DDoS attack. I have decided to setup fail2ban but as far as I can understand, that will only take care of the ssh login attacks. How can I stop these SYN DDoS ...
0
votes
1answer
889 views

How to protect from spoofed SYN flood on a Linux machine? [duplicate]

I have a server (2 x E2620, 32 GB RAM, Debian 6 Linux us-fw 2.6.32-5-amd64 #1 SMP Mon Feb 25 00:26:11 UTC 2013 x86_64 GNU/Linux, 10G Intel Ethernet Card). It has an Nginx proxy server inside. Idea is ...
2
votes
1answer
690 views

Fighting DDoS Attack, looking for some advice [duplicate]

So, it appears about 2 IP addresses are overloading my HTTP server (apache) over UDP and I am unable to stop this using IP Tables. I am using CentOS 5. I managed to block some other IP addresses that ...
0
votes
2answers
1k views

Is Apache mod_evasive has same function as Lighttpd mod_evasive? [duplicate]

Apache mod_evasive description: When possible attacks are detected, mod_evasive will block the traffic from the source for a specific duration of time, while reports abuses via email and syslog ...

15 30 50 per page