A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
9 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
-1
votes
0answers
17 views

Why have I got so many connections on port 80?

I am playing around with apache that is hosting a wordpress themed website. After a few days exposed to the public, I noticed that I have many connections to port 80 but it does not receive any ...
8
votes
2answers
1k views

Is it possible to have a secondary managed DNS provider to quickly delegate to when DDOS attack on our *primary* external DNS provider happens?

So our DNS provider, every so often, experiences DDOS attacks on their systems that causes our front-facing web sites to go down. What are some options in terms of reducing dependency on a SINGLE ...
-1
votes
1answer
29 views

How can I only allow TCP connections for 1 port using iptables on Unbantu? How can I also set a maximum packet on a connection?

I'm running a server for public. I just want to allow TCP connections and I want to limit the packet to prevent ddosing a bit and setting a maximum IP/new connections per seconds with iptables. How ...
0
votes
1answer
18 views

Solid way to set up DDoS protection for a SaaS with many customer domains

I will be launching a SaaS soon. Customers will be able to sign up and get their own 'space'. Each customer will get a generated sub domain plus they can add their own custom domain if they wish too. ...
1
vote
0answers
26 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
1answer
62 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
1
vote
0answers
39 views

Using a VPS as front end proxy

I run a shell host that many users share which gets frequently DDoS'd (at least once every other month). So I have come up with a plan to peer all traffic with a VPS, so that it appears to everyone ...
-1
votes
2answers
36 views

Fallback between datacenters

What is the best way to do a fallback between datacenters. We have a dedicated server in one of the data centers and as our traffic increased i wanted to add more then backup i wanted redundancy and ...
0
votes
2answers
79 views

I'm trying to stress test a site but no hosting company will let me. What can I do?

We need to know what to expect if a rogue actor DDOSes one of our production sites, so I'm looking to spin up a few VPSes with web apps on so that I can simulate a DDOS against them with an online ...
0
votes
0answers
12 views

Ofbiz Ubuntu Server Vulnerability [duplicate]

My EC2 Instance is running ubuntu 14.04 and apache ofbiz-14.02. I found a python file was uploaded to server in ofbiz installation folder which I highly suspect it is the fraud by ofbiz which allowed ...
1
vote
0answers
40 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
30 views

nginx stub status SPIKES “writing” for a few seconds, causing 504 error. Why?! Bad VPS neighbour?

I am using Apache and nginx as reverse proxy, with php5-fpm. The latest week we've been receiving the following error in nginx's error.log: upstream timed out (110 connection timed out) while reading ...
-2
votes
1answer
96 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
0
votes
0answers
72 views

nginx req limit & fail2ban & cloudflare large attacks

I started to use as the topic says nginx with req limit + fail2ban + cloudflare. If someone exceeds the requests on any php file the ip gets blocked over the cloudflare api in the "ip firewall" on ...
0
votes
0answers
17 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
1
vote
2answers
18 views

Quantifying site response in case of DOS/DDOS attack tests

Let us say that we need to test a HTTPS web site for vulnerability/response in case of DOS/DDOS attacks. Among other tools, we can use GoldenEye for this purpose. We can vary the number of workers ...
-4
votes
2answers
98 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
0
votes
1answer
20 views

Preventing IP address from hitting Apache Tomcat by configuring Apache

We got Tomcat that needs to be restarted quite often on our production. Examining Apache access log file, I can see that certain IP addresses are hitting same logon page hundreds of times one after ...
0
votes
1answer
32 views

how to block access for RSS Feed using htaccess

My website is experiencing RSS Feed problem I get this htaccess code Order deny,allow Deny from all Allow from xx.xx.xx.xx but it blocks all IP address i just need to block mywebsite.com/feed.php ...
-2
votes
1answer
64 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
84 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
1
vote
1answer
140 views

DDOS mitigation of GCE

I am hoping to start shared hosting service on Google Compute Engine. Does the Google infrastructure have any DDOS mitigation built-in? This article here says it does. "Compute Engine makes use of ...
0
votes
0answers
12 views

Digital Ocean locked my droplet saying it was compromised and participating in ddos. How can I look into this? [duplicate]

I have a digital ocean droplet and I got a support ticket sent to me saying they've had to lock my droplet because it was flooding their network, assuming it has been compromised and performing ddos ...
0
votes
0answers
42 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
0
votes
1answer
59 views

Wrodpress DDOS /xmlrpc.php

This is what my nginx access.log looks like as I write this times infinity: 127.0.0.1 - - [19/Jan/2016:00:59:36 -0500] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; ...
2
votes
3answers
96 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. ...
0
votes
0answers
27 views

Clinet-side solutions to prevent DNS amplification without rate limiting on an open DNS server? [duplicate]

Are there alternative ways to operate an open/forwarding DNS server, without having to use rate limiting or other means of traffic inspection to prevent being used for DNS amplification attacks? ...
-1
votes
1answer
63 views

DDos attack ToS Violation - Outbound DoS [duplicate]

Fount ddos attack on ubuntu server netstat -nputw given outout Local Address Foreign Address State PID/Program name 55.57.72.37:59792 123.166.137.95:25000 SYN_SENT ...
0
votes
0answers
31 views

How to monitor AWS EC2 instance in order to recognise DDOS and identify bottlenecks? [duplicate]

I have web app (NodeJs) running on AWS EC2 Ubuntu instance. I would like to monitor it somehow so I would be able to quickly recognise DDOS attacks. I would also like to identify bottlenecks etc. What ...
0
votes
1answer
312 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
1
vote
2answers
116 views

Protecting private IP address using Google for Work's SMTP settings

We currently got a website that is protected with cloudflare, however there is one leak we found. Our server's IP is shown in email headers, which makes cloudflare kinda useless at this point. We've ...
-1
votes
2answers
69 views

AWS DNS DDoS mitigation

I have an AWS server that is currently under DDoS via DNS amplification. I've setup CloudWatch logs for the VPC ACL and it's logging an enormous amount of rejected DNS traffic. Despite that traffic ...
0
votes
0answers
121 views

I can DDOS my server with one client by doing ctrl+F5

First of all I really don't know where I should start my investigation. I'll post the configuration files as soon as you'll ask. The server is windows 2008 R2 with Apache 2.4.9 and PHP 5.6. on a VM, ...
0
votes
0answers
50 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
0answers
48 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
0
votes
0answers
42 views

nginx deny POST requests to the index route

i recently noticed DDos-like attacks on my server and now i'm in charge of trying to reduce the damage they deal. They aren't that heavy, but it's enough for the poor performance my server delivers. ...
0
votes
0answers
16 views

Massive DDoS hitting my VPS, no idea what to do [duplicate]

for the past few days there has been a massive amount of connections hitting my VPS. I am not sure whether my VPS is actually being attacked or just being used for DDoSing someone else's server. ...
2
votes
1answer
378 views

many graceful restarts in httpd error log?

Our server was down , and we restatred the services (nginx & httpd), and when i look at the logs, i've found these lines , there are so many Graceful restart requested, doing restart lines, whats ...
0
votes
1answer
56 views

How do black holes mitigate ddos attacks?

I'm looking at how to try and prevent DDOS attacks before I launch a website as I will expect lots of online 'booters' to attack the server. I've read through lots of threads on here and ...
0
votes
0answers
10 views

How to block fake googlebots with haproxy? [duplicate]

We want to block all requests coming from non google ips but identify as a bot from google.
1
vote
2answers
190 views

block fake google bots [duplicate]

How could I block DDOS attacks with fake Google bots? I found 2 solutions on the net. But both seems to block also correct google bots. # Block fake google when it's not coming from their IP range's ...
1
vote
0answers
100 views

Drop first packet for every IP with iptables

My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets. Is there a way to drop the first packet received ...
0
votes
1answer
79 views

Should I expect reception of packets in hping3 --flood?

I'm testing a newly purchased VPS for DDoS vulnerability using hping3. If I do not use --flood, everything goes fine and I see close to 0% packet loss every time. But If I do use --flood, then the ...
0
votes
0answers
64 views

Php5-cgi, 503 error or DDoS attack?

I am trying to figure out if these things are connected. Until yesterday I had some CPU/RAM spikes on random times that could last for hours/days all connected with 30-40 php5-cgi processes being run ...
1
vote
0answers
28 views

Simple anti DDoS protection in FreeBSD [duplicate]

I have a lot of request from data centers to my web server on FreeBSD and sometimes it've have a lot of performance problem with my web projects. Adding to IPFW list all IP's data centers is ...
-1
votes
1answer
89 views

I think I am getting ddos-ed, have I taken proper precautions? [closed]

I noticed my SQL server was down on my wordpress website, 2 days ago. I couldn't figure out why I wasn't able to restart the SQL server so I looked at my logs. I noticed this one IP was hitting my ...
0
votes
1answer
265 views

NGINX not responding during DDoS attacks

I'm going to get straight to the point, NGINX doesn't seem to handle any HTTP requests during a DDoS attack using XML-RPC. The server only uses about 1% of the CPU during an XML-RPC DDoS attack. The ...
0
votes
1answer
117 views

Nginx limit_conn inheritance

I am trying to protect Drupal running on Nginx from simple DDoS with limit_conn and limit_req. But I encountered some strange behavior with inheritance of limit_conn directive which I cannot explain. ...
0
votes
0answers
80 views

How to prevent outgoing UDP flood

I've been googling for hours now but can't find a sure or helpful answer. I need to disable high-volume outgoing UDP from my server. I'm trying to configure APF because of the RAB functionality, but ...