Linked Questions

8
votes
8answers
14k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
2
votes
4answers
4k views

How can I stop a currently active DDoS attack? [duplicate]

My VPS is under a DDoS attack. I cannot access RDP, and I cannot take it offline, or access it in any way at all. What can I do? They are not trying to bruteforce, just trying to stop access to the ...
3
votes
6answers
9k views

How long do DDoS attacks last? [duplicate]

I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last? Just trying to get an idea of how long we'll have to ...
4
votes
3answers
745 views

100mb/s upgrade to 1gbps network - To Prevent DDOS [duplicate]

I have been under constant DDOS attack the last couple of weeks. Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages. I run ...
0
votes
3answers
5k views

Block All UDP traffic (to prevent ddos) [duplicate]

I have been receiving countless ddos attacks the last couple of weeks. Just now I caught one while I was running iptraf. Normally 99.9% of the packets used on my server are TCP packages, and not UDP. ...
8
votes
6answers
604 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
3
votes
1answer
6k views

How can I detect a DDoS attack using pfSense so I can tell my ISP who to block? [duplicate]

Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host. I understand (from this ...
4
votes
6answers
2k views

How to survive anonymous DDOS attack? [duplicate]

Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional. I read (basic theory) about dealing with normal DDOS ...
6
votes
2answers
10k views

Too many TIME_WAIT state connections! [duplicate]

I've been reading about this everywhere all day, and from what I've gathered, TIME_WAIT is a relatively harmless state. It's supposed to be harmless even when there's too many. But if they're jumping ...
5
votes
4answers
2k views

Mitigate DDoS attack with HAProxy [duplicate]

We were targeted earlier today by a DDoS attack. There was 20x as many connections as normal on our load balancer (HAProxy), and all the backend nodes continued to go down during this attack. System ...
2
votes
2answers
734 views

DDoS Attacks on Game Servers [duplicate]

We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
0
votes
4answers
5k views

How to prevent DDOS syn attack [duplicate]

I am running a site with 2 GB ram on centos. Using LAMP Everyday for a few hours (about 3 to 4 hours) apache goes down. It takes too long to load a page and most of time it shows Request time out. ...
3
votes
5answers
2k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
4
votes
2answers
6k views

How Can I Harden the TCP/IP Stack in Windows Server 2008? [duplicate]

I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks. There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
3
votes
5answers
929 views

Incoming DDoS Attack, It Looks Like An ICMP Attack, So What Do I block? [duplicate]

I recently have been getting hit by an attack that is very small around 70MBPS but causes TONS of upload...All signs point to ICMP. I realized in my firewall I have CSF firewall running on CentOS, ...
1
vote
2answers
8k views

How do you prevent UDP-flood based DDOS attacks on a DNS server? [duplicate]

I'm studying networking at the moment, and it just occurred to me that one can easily forge DNS requests with fake IP addresses (since they use UDP). Since DNS relies on UDP for communication, ...
2
votes
3answers
4k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
2
votes
6answers
567 views

Securing against DDoS [duplicate]

My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
3
votes
2answers
962 views

Can DDoS be stopped with BGP? [duplicate]

When I am experiencing DDoS @10Gbps, if I have BGP router with 10M table entries in it, can I perform search on the offensive network? I would do this the way, that first I would remove routing to me ...
0
votes
1answer
3k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
3
votes
3answers
421 views

Can't stop DDOS [duplicate]

I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it. (1gbs is the maximum speed of the server.) I've the following iptables rules: ...
6
votes
5answers
1k views

DDoS Protection Services - are they good enough? [duplicate]

first of all, I understand that it's better to have DDoS protections on data center level. But our DC is not ready to provide good quality of protection. So we thinking about using some external DDoS ...
3
votes
2answers
2k views

Allowing apache to write with iptables [duplicate]

Since to days ago I'm receiving DDOS atacks in my server. I've installed mod_evasive in apache and it works right! It writes the log and send the email with de IPs. But there's a problem: Apache ...
1
vote
1answer
8k views

Snort rules for syn flood / ddos? [duplicate]

Can someone provide me rules to detect following attack : hping3 -S -p 80 --flood --rand-source [target] I'm having problem with rules since packet comes from random source. My current rules is : ...
1
vote
2answers
1k views

Varnish and Connection Flood (DoS - DDoS) [duplicate]

I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
2
votes
5answers
612 views

DDoS attacks [duplicate]

How to prevent DDoS attacks on Windows/IIS servers ?
2
votes
4answers
2k views

Mitigating an http flood? [duplicate]

I have a ddos protection proxy in place to deal with SYN floods and such. But http floods are still getting through. For some reason their ddos proxy is not blocking any of the flood. So there are ...
2
votes
4answers
334 views

Apache getting DDoS [duplicate]

My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
2
votes
4answers
3k views

How to protect Lighttpd from DOS attacks and flooding? [duplicate]

I have a problem with Lighttpd because someone started to use some Web downloader from very good connection and it blocked my whole website. Is there any way to protect Lighttpd from DDOS attacks and ...
1
vote
5answers
615 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
3
votes
3answers
617 views

In Linux, does using route to blackhole an IP result in better performance than dropping in iptables? [duplicate]

During a DDOS attack, if we are finding IPs we want to block will we see better performance using a null route as opposed to iptables? Null routing we would do something like: ip route add blackhole ...
0
votes
3answers
722 views

DDoS - How to detect an attacker IP address [duplicate]

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
1
vote
2answers
505 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...
-2
votes
2answers
645 views

DDoS Mitigation with round robin DNS? [duplicate]

Alright, so my friend and I are setting up a new website. We expect heavy DDoS attacks, so our plan is to use nginx to proxy from various cloud servers so that people can't find our actual server's ...
1
vote
4answers
633 views

Distributed web server to stop DDos attacks? [duplicate]

I have been thinking about a way to hinder DDos (Distributed Denial of Service) attacks (which seems to be a hot topic at the moment) by placing a signed Java Applet on the web site. This Java Applet ...
-2
votes
1answer
563 views

Possible form for a ddos attack? [duplicate]

I have kinda asked this before. I've set up a server that serves my website, dns and some gameservers. However, when I check my routers firewall log, I get alot of incoming UDP packets blocked on the ...
1
vote
4answers
708 views

Solution for DDOS [duplicate]

My server is under DDoS attacks. I see my access log and get something: 968966 93-97-53-41.zone5.bethere.co.uk - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" ...
1
vote
1answer
1k views

pfSense + DDoS Protection [duplicate]

I run a gaming community on a colo with a 100Mbps port. I want to buy a very cheap 35 dollar server with the same 100Mbps port, and run pfSense to use as a hardware firewall. I'm dealing with a bunch ...
4
votes
2answers
322 views

How to prevent DDoS attacks? [duplicate]

I am a creator of a flash game server. I use cloudflare for my site, however the game tcp server cant be protected by CloudFlare. For about 2 months some person DDoSes my game using direct ip. Every ...
2
votes
3answers
522 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
4
votes
2answers
853 views

DDOS attack - How to prevent [duplicate]

Recently I read about Denial of Service attack on Amazon & PayPal. I am curious that how this is performed. These big companies must have huge servers, so DOS would require billions of bots to ...
3
votes
3answers
392 views

Anti-DDoS Question [duplicate]

Our company┬┤s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have ...
1
vote
2answers
1k views

Using Free/Open BSD + pf as a DDoS filter [duplicate]

Is using Free/Open BSD + pf a workable option for filtering DDoS? Which of the two would perform better under heavy load? (SYN flood maxing a 1 gbit pipe) Is this even an option to consider, or is a ...
3
votes
2answers
132 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a ...
0
votes
2answers
1k views

Am I under DDOS? [duplicate]

I have a mail server, Debian Linux 2.4.31, which is dropping TCP connections and basically being unavailable. I have iptables running on it and its pretty much very restrictive. When I run "netstat ...
2
votes
1answer
140 views

Received Notification of my server be involved in “DNS amplification attack”. How can I stop? [duplicate]

I just received an email from my website internet provider that my server has been "involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks." Here is the full email: ...
4
votes
3answers
376 views

I know how to scale my software, but how to prevent downtime because of network outages? [duplicate]

We are running rather large LAMP sites which scale well software wise. We use redundant load balancers in front of a bunch of webservers using MySQL via a proxy in master-slave-slave-slave. We are ...
1
vote
1answer
352 views

DROP vs REJECT DDoS [duplicate]

I asked somewhere else, and I got this response: Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine ...
2
votes
3answers
570 views

ddos protection for dedicated server [duplicate]

Whats the best way to protect a linux root server from a ddos attack? I just want to inform myself about the issue. I'm wondering I haven't found a good solution. anybody has one? thanks!
1
vote
3answers
658 views

ESXi server under DoS attack, can I use SSH to determine where from? [duplicate]

My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host. I ...

15 30 50 per page