Linked Questions

1
vote
1answer
383 views

Is mod_evasive the best prevention to DDOS attack [duplicate]

I already have IPTables blocking all unnecessary traffic. Is mod_evasive the best solution for something like this? What do you use on your server?
3
votes
1answer
486 views

Stopping SYN DDoS Attack [duplicate]

One of my servers is under constant SYN DDoS attack. I have decided to setup fail2ban but as far as I can understand, that will only take care of the ssh login attacks. How can I stop these SYN DDoS ...
2
votes
1answer
602 views

Fighting DDoS Attack, looking for some advice [duplicate]

So, it appears about 2 IP addresses are overloading my HTTP server (apache) over UDP and I am unable to stop this using IP Tables. I am using CentOS 5. I managed to block some other IP addresses that ...
0
votes
2answers
591 views

IP Address filter 'before' http secured connections for protection against DDoS attacks? [duplicate]

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an ...
1
vote
2answers
658 views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
0
votes
1answer
838 views

Preventing DDOS/SYN attacks (as far as possible) [duplicate]

Recently my CENTOS machine has been under many attacks. I run MRTG and the TCP connections graph shoots up like crazy when an attack is going on. It results in the machine becoming inaccessible. My ...
3
votes
2answers
496 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
0
votes
2answers
786 views

Protection against Ddos Syn Flood [duplicate]

My dedicated server can't handle more than 4Mbits/s of bandwidth. After that, the server don't ping anymore. My provider told me it's because my server isn't well configured. When I look in the logs ...
0
votes
1answer
583 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
2answers
271 views

Locating Source of Inbound DDOS [duplicate]

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
1
vote
1answer
239 views

trying to prevent ddos with cisco pix 501 [duplicate]

I'm getting dos on a dedicated server with windows+apache, ive asked support to install a firewall and got a cisco pix 501, the attacks are on port 80 to a certain site, what can I do to block it? I ...
0
votes
1answer
500 views

How to protect from spoofed SYN flood on a Linux machine? [duplicate]

I have a server (2 x E2620, 32 GB RAM, Debian 6 Linux us-fw 2.6.32-5-amd64 #1 SMP Mon Feb 25 00:26:11 UTC 2013 x86_64 GNU/Linux, 10G Intel Ethernet Card). It has an Nginx proxy server inside. Idea is ...
0
votes
2answers
365 views

Is my server under a DDOS attack? [duplicate]

I'm getting repeat requests for resources on my server and this is increasing the load greatly. Currently my load is at 2.5ish. I block individual IP addresses causing the problem but eventually the ...
0
votes
1answer
421 views

Why is nginx taking so long to reply? [duplicate]

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
0
votes
1answer
300 views

Help - DDOS Attack [duplicate]

I am under a DDOS attack. I'm trying to locate the IP address that is making 1100+ connections, however, when running the following command, it shows a 1100+ connection, but the ip address column is ...

15 30 50 per page