A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

1
vote
0answers
40 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
51 views
+50

High outbound network traffic on Tomcat under process nodeJR

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...
-1
votes
0answers
16 views

APF blocking my IP When I view site and browse few pages

I recently installed APF with BFD on Centos 6.5 to stop frequent attacks on my VPS. But for some reason, APF is black listing my own IP (which is dynamic) when I go to my site and browse few pages. ...
1
vote
0answers
23 views

Multiple DDOS protection interfaces merging on one TS server

The problem I have is I have 3 DDOS protection interfaces from a multi homed DDOS protection solution and teamspeak is refusing to return packets via the correct interface (aka the one that sent it ...
0
votes
0answers
22 views

Apache2 php-cgi processes, how to limit them?

I have a 32gig ram dedicated server running on Ubuntu 12.04 with ISPConfig / Apache configuration. The thing is, anyone can take the site down simply by holding down F5 button for 20 seconds causing ...
2
votes
1answer
78 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
0
votes
1answer
38 views

Apache logs flooded with connections - “(via ggpht.com GoogleImageProxy)”

My server was running on 100% CPU and looking at the Apache logs I saw hundreds of thousands of connections that looked like this: 10.190.45.31 - - [13/Mar/2014:15:29:02 +0000] "GET SOMETHING ...
-1
votes
1answer
59 views

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea ...
-1
votes
1answer
26 views

How to tell if the server was down because of DDoS of another reason?

my server was down for a couple of hours during the night. i see in the cpu load monitoring in the amazon AWS console that it was 100% load. also, the network in jumped (but no that dramatically) so ...
0
votes
0answers
95 views

postfix queue active and mail transport unavailable

I am not very familiar with postfix, but I am pretty sure that what I am seeing in my logs is not a good thing, and I was hoping someone here might be able to shed some light on what is going on and ...
2
votes
2answers
65 views

Will MX records with a longer TTL help mitigate effects of DoS attack?

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
1
vote
1answer
36 views

Apache MySQL Server Crashing - Large number of connections from localhost

I'm running a 2GB Centos 5.9 server with the standard LAMP setup. I'm running a wordpress website so it's nothing to demanding performance wise. However the MySQL server seems to keep crashing as I ...
1
vote
2answers
787 views

Apache - How to limit Content-Type header length to avoid CVE-2014-0050?

On Thursday a DoS problem with Tomcat was announced in a Tomcat mailing list ("[SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS"). An attacker seems to be able to cause an ...
4
votes
5answers
1k views

How can I defend against a DRDoS exploiting NTP server on an ESXi host?

Recently, we had some problems with one of our ESXi servers, caused by the NTP Server DRDoS Amplification Attack using ntpdc. How do I configure the NTP server on ESXi to not be exposed to this DDoS ...
11
votes
1answer
477 views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
1
vote
1answer
57 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
0
votes
0answers
72 views

My Bitnami Tomcat Stack (on EC2 AWS) is generating DoS attack

I have a very small java web app that is deployed on a Bitnami Tomcat Stack on AWS. We are using this app in the company with only 5-10 user base daily, and generating only below 100MB of traffic per ...
0
votes
1answer
418 views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
3
votes
3answers
338 views

Can't stop DDOS [duplicate]

I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it. (1gbs is the maximum speed of the server.) I've the following iptables rules: ...
0
votes
1answer
116 views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
5
votes
3answers
1k views

DDOS using ntp server

I've heard about new kind of DDOS where ntp is used for reflection . My questions are really simple : Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose ...
1
vote
1answer
57 views

How to avoid DoS in a proxy environment with 1 IP only

We have lots of servers behind a proxy (nginx) and an IP. Users are reaching to their servers through proxy. We add their domain to proxy and route traffic to their servers. The problem is sometimes ...
1
vote
0answers
55 views

sshd running at 100%

I'm running an Ubuntu/WordPress server on Amazon EC2 which is experiencing problems every 24-48 hours: I get a CPU alarm from EC2, log into the server, and discover sshd is running at 99.9% CPU. This ...
0
votes
2answers
34 views

Ideas for redundant / geographically optimized web hosting solution

I need to setup a web hosting solution with the following requirements: No single point of failure. Ability to handle reasonable DDOS attacks (non traffic saturation types) Servers located in ...
2
votes
1answer
1k views

/usr/bin/host being used in HTTP DDoS on Debian? [duplicate]

So I got an abuse complaint for one of my dedicated servers, running Debian 6.0 Sure enough, sometimes, top shows /usr/bin/host using a lot of CPU for no apparent reason, and netstat shows process ...
1
vote
4answers
266 views

Can a ddos attack stop me from ssh'ing into my server?

SOLUTION NOTES Wow so many great things to think about. We have installed mod-security and looking into Monit. Plus not that I don't like my boss but he is not an I.T. guy in profession nor hobby so ...
2
votes
2answers
96 views

How can I mitigate DNS Server outages?

Let's say I have a root domain of "mysite.com". That domain and its sub-domains have DNS served by an external service - let's call them Setwork Nolutions. If this external company is hit with a DDoS ...
0
votes
0answers
52 views

Drop in HAproxy traffic with increase in connections

We have an intermittent issue that involves a severe drop in network traffic (both IN and OUT) on our HAProxy load balancer. It happens a couple times a day. HAProxy is configured to limit requests ...
5
votes
1answer
85 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
0
votes
0answers
116 views

What advantages does mod_evasive have over mod_security2 in terms of DDOS protection?

I'm running an Apache2 server in front of a Tomcat and I need to implement a DDoS protection mechanism on the Apache2 layer. I have two candidates: mod_evasive and mod_security2 with the OWASP core ...
-3
votes
1answer
39 views

Is there a way on the server side to punish evil visitor? [closed]

For example an admin page that should not be visited unless with special cookie or query string token. The point being that anyone who tried and failed would likely be with bad intention. Or when the ...
0
votes
0answers
98 views

DDoS attack simulation using MININET

I´m developing some dynamic security policies using SDN, one of them consist in how the network should respond to a DDoS attack detection. So, I would like to test my policies but I'm having some ...
0
votes
0answers
68 views

server reached MaxClients setting, consider raising the MaxClients setting

this is my mod-status report. Do you think I could be under a DDOS attack? Thanks Current Time: Monday, 14-Oct-2013 18:56:57 CEST Restart Time: Monday, 14-Oct-2013 18:54:48 CEST Parent Server ...
0
votes
2answers
228 views

Apache DDOS Prevention

Moved from Stackoverflow. I have a LAMP server running Ubuntu with security programs such as Denyhosts, Fail2ban and with Mod_security installed but seem to constantly be the target of a DDOS attack. ...
0
votes
1answer
598 views

Recent module, what is preferred rcheck or update?

Let's say I have the following rules: iptables -P INPUT DROP iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A ...
0
votes
1answer
77 views

DDoS Protection [closed]

Let's say I order a half rack (22U) at any colocation company. They give me a GiGe port and I need DDoS protection. If I use a slot in my rack for Arbor protection, will I be protected up to a certain ...
0
votes
0answers
14 views

Intelligently filtering bogus query strings

A vBulletin site I maintain is on the wrong end of a DoS attack which is inexplicably routing through CloudFlare unimpeded by their DoS protection. The requests look like this: 1 /?ZZZZCQG=XJXAUD ...
-2
votes
1answer
94 views

DDoS Attacks & Convictions [closed]

I could probably make a better title, edit it if you find a better way of phasing my problem. Basically what's happened is that a gameserver host thinks I keep attacking their dedicated server with a ...
0
votes
2answers
136 views

Protection against scrapping with nginx

This morning we had a crawler going nuts on our server hitting our site almost 100 times per second. We'd like to add a protection for this. I guess I'' have to use HttpLimitReqModule but I don't ...
1
vote
1answer
61 views

How to setup Microsoft DNS so it does not contribute to DNS amplification attacks

I am using a Microsoft DNS server to host both our internal and external DNS. This means that recursive lookups needs to be turned on, or internal users will not be able to perform DNS queries. ...
1
vote
1answer
72 views

Bingbot spoof localhost ip

So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request: 127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" ...
0
votes
1answer
44 views

Is there a service I can redirect/report DDoS clients to?

Currently experiencing a very mild DDoS attack. Just a brute force login attack. This caused a spike in PHP/MySQL usage so I've just blocked logins except from my IP address. I'm not too worried about ...
0
votes
1answer
142 views

How to interpret this jnettop output?

Looks like I'm currently under a DOS attack or something like that, I've been monitoring the traffic on the server using jnettop, this is a of what I see during normal conditions: ...
1
vote
3answers
273 views

High CPU usage in random IP/Port UDP DDoS

I have been getting these UDP floods with random IPs and ports. randomip:randomport -> myip:randomport 0 byte payload For some reason it is using a lot of CPU. Here is the results of perf top -e ...
0
votes
1answer
83 views

Automation of blocking IP address

I have an Ubuntu 12.04 machine running Apache2 which hosts about 10 wordpress websites. Recently I have been subjected to attacks from clients which seem to be sending POST requests to a wordpress ...
5
votes
3answers
234 views

Correct way to handle security threats to web server on budget [closed]

During our annual security review I was reminded of an incident earlier this year where we received a threat to our organizations web server. It was over a organization policy and threatened to DDoS ...
-1
votes
3answers
226 views

How to fight request spam (DDOS i guess) on CentOS server [duplicate]

lately i'm trying to fight DDOS on my CentOS 6.4 server. I have installed CSF and I've set it quite strictly. Yet there is a URL that have like 1000 requests and max 2 per IP (smart ddos-er I guess). ...
0
votes
0answers
188 views

Blocking a TCP Syn Attack

I have recently experienced a TCP Syn attack and since it was from a software like LOIC, it kept happening until I banned the IP Addresses or stopped my system from making output to them. Here is what ...
0
votes
0answers
36 views

Blitz.io reporting large number of timeouts - servers seem fine though

I'm using a web service called blitz.io (not sure how popular it is?) to test the reliability of my web servers under heavy loads. The command I'm using is as follows: -p 1-1000:60 -r ireland ...
0
votes
2answers
150 views

Denial of Service coming from Facebook IP addresses

We have a website which appeared to suffer from a denial of service attack. There were several IP addresses involved and these were all registered to Facebook. Here's an excerpt from the Apache log ...