A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

-1
votes
2answers
33 views

Block incoming traffic from unresolved IP address

How can I block all the incoming traffic from unresolved IP addresses? I am using CentOS with WHM/cPanel installed. I am getting huge junk traffic and 95% is from unresolved IP addresses and only 5% ...
0
votes
1answer
30 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
1
vote
1answer
25 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
0
votes
1answer
37 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
0
votes
1answer
27 views

Lots of connections to loopback, could be slowing us down

I'm trying to debug a sudden increase in our load average. I looked at this page to see if we were being DDoS'ed but the standout IP address was the loopback address: $ netstat -ntu | awk '{print ...
0
votes
0answers
59 views

Is it DDOS attack?

For three successive days, now, I'm having four or five unique servers' queries being denied by my csf firewall, which are renamed in the following extract I got from my log as "www.example1.com", ...
0
votes
1answer
95 views

.htaccess rules to stop DDoS POST flooding

We're under a distributed denial of service attack from traffic that looks like this: 49.146.161.175 - - [11/Jul/2014:00:43:42 -0400] "POST / HTTP/1.1" 500 557 "-" "Mozilla/4.0 (compatible; MSIE 6.0; ...
1
vote
2answers
61 views

blocking udp attack ip with iptables

I was trying to block an ip of ( network stresser tool - a ddos websites selling ddos bots by seconds online ) the first one i was trying to block with iptables : iptables -A INPUT -d 173.193.26.73 ...
1
vote
1answer
59 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
1
vote
2answers
78 views

Does CloudFlare make a site a greater potential DDOS target?

CloudFlare has gotten a lot of press recently as protecting businesses from DDOS attacks. But from looking at their twitter feed, it looks like they are targeted every day, and large segments of their ...
0
votes
3answers
184 views

My webserver is getting flooded with invalid requests

My webserver (nginx) keeps getting requests like this: 23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET ...
0
votes
0answers
48 views

How do you protect your <appid>.appspot.com domain from DDOS attack?

If I want to use CloudFlare to help protect my GAE app via it's custom domain, I still am vulnerable to attacks directly on the .appspot.com domain. How do I mitigate that? I could force redirect ...
0
votes
0answers
10 views

Repeated installation of malicious software to do outbound DDOS attack [duplicate]

We have a Ubuntu Vitual Private Server hosted by a Canadian company. Out VPS was affected to do "outbound DDOS attack" as reported by server security team. There are 4 files in /boot looks like ...
0
votes
1answer
207 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
1
vote
2answers
39 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
-2
votes
2answers
86 views

Is it possible to prevent DDoS attacks? [closed]

I recently read that certain industries—including the one I work in—are more likely than others to be targeted by a DDoS attack. Can you give me some tips on how to prevent DDoS attacks?
2
votes
1answer
234 views

SynFlood attack, spoofed IPs, syncookies mitigation

Due to a recent increase in SynFlood attacks on my company's systems i've been testing by Syn flooding the hosts myself to see how easy they are to disrupt, and the answer is 'quite easy'. By using a ...
1
vote
0answers
178 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
357 views

High outbound network traffic on Tomcat under process nodeJR

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...
1
vote
0answers
43 views

Multiple DDOS protection interfaces merging on one TS server

The problem I have is I have 3 DDOS protection interfaces from a multi homed DDOS protection solution and teamspeak is refusing to return packets via the correct interface (aka the one that sent it ...
0
votes
0answers
112 views

Apache2 php-cgi processes, how to limit them?

I have a 32gig ram dedicated server running on Ubuntu 12.04 with ISPConfig / Apache configuration. The thing is, anyone can take the site down simply by holding down F5 button for 20 seconds causing ...
2
votes
1answer
252 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
0
votes
1answer
299 views

Apache logs flooded with connections - “(via ggpht.com GoogleImageProxy)”

My server was running on 100% CPU and looking at the Apache logs I saw hundreds of thousands of connections that looked like this: 10.190.45.31 - - [13/Mar/2014:15:29:02 +0000] "GET SOMETHING ...
-1
votes
1answer
152 views

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea ...
-1
votes
1answer
34 views

How to tell if the server was down because of DDoS of another reason?

my server was down for a couple of hours during the night. i see in the cpu load monitoring in the amazon AWS console that it was 100% load. also, the network in jumped (but no that dramatically) so ...
1
vote
0answers
1k views

postfix queue active and mail transport unavailable

I am not very familiar with postfix, but I am pretty sure that what I am seeing in my logs is not a good thing, and I was hoping someone here might be able to shed some light on what is going on and ...
2
votes
2answers
79 views

Will MX records with a longer TTL help mitigate effects of DoS attack?

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
1
vote
1answer
64 views

Apache MySQL Server Crashing - Large number of connections from localhost

I'm running a 2GB Centos 5.9 server with the standard LAMP setup. I'm running a wordpress website so it's nothing to demanding performance wise. However the MySQL server seems to keep crashing as I ...
1
vote
2answers
1k views

Apache - How to limit Content-Type header length to avoid CVE-2014-0050?

On Thursday a DoS problem with Tomcat was announced in a Tomcat mailing list ("[SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS"). An attacker seems to be able to cause an ...
4
votes
5answers
2k views

How can I defend against a DRDoS exploiting NTP server on an ESXi host?

Recently, we had some problems with one of our ESXi servers, caused by the NTP Server DRDoS Amplification Attack using ntpdc. How do I configure the NTP server on ESXi to not be exposed to this DDoS ...
12
votes
1answer
2k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
1
vote
1answer
89 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
0
votes
0answers
181 views

My Bitnami Tomcat Stack (on EC2 AWS) is generating DoS attack

I have a very small java web app that is deployed on a Bitnami Tomcat Stack on AWS. We are using this app in the company with only 5-10 user base daily, and generating only below 100MB of traffic per ...
0
votes
1answer
1k views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
4
votes
3answers
450 views

Can't stop DDOS [duplicate]

I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it. (1gbs is the maximum speed of the server.) I've the following iptables rules: ...
0
votes
1answer
407 views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
5
votes
3answers
2k views

DDOS using ntp server

I've heard about new kind of DDOS where ntp is used for reflection . My questions are really simple : Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose ...
1
vote
1answer
79 views

How to avoid DoS in a proxy environment with 1 IP only

We have lots of servers behind a proxy (nginx) and an IP. Users are reaching to their servers through proxy. We add their domain to proxy and route traffic to their servers. The problem is sometimes ...
1
vote
0answers
132 views

sshd running at 100%

I'm running an Ubuntu/WordPress server on Amazon EC2 which is experiencing problems every 24-48 hours: I get a CPU alarm from EC2, log into the server, and discover sshd is running at 99.9% CPU. This ...
0
votes
2answers
43 views

Ideas for redundant / geographically optimized web hosting solution

I need to setup a web hosting solution with the following requirements: No single point of failure. Ability to handle reasonable DDOS attacks (non traffic saturation types) Servers located in ...
2
votes
1answer
3k views

/usr/bin/host being used in HTTP DDoS on Debian? [duplicate]

So I got an abuse complaint for one of my dedicated servers, running Debian 6.0 Sure enough, sometimes, top shows /usr/bin/host using a lot of CPU for no apparent reason, and netstat shows process ...
1
vote
4answers
630 views

Can a ddos attack stop me from ssh'ing into my server?

SOLUTION NOTES Wow so many great things to think about. We have installed mod-security and looking into Monit. Plus not that I don't like my boss but he is not an I.T. guy in profession nor hobby so ...
2
votes
2answers
123 views

How can I mitigate DNS Server outages?

Let's say I have a root domain of "mysite.com". That domain and its sub-domains have DNS served by an external service - let's call them Setwork Nolutions. If this external company is hit with a DDoS ...
0
votes
0answers
96 views

Drop in HAproxy traffic with increase in connections

We have an intermittent issue that involves a severe drop in network traffic (both IN and OUT) on our HAProxy load balancer. It happens a couple times a day. HAProxy is configured to limit requests ...
5
votes
1answer
101 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
0
votes
0answers
143 views

What advantages does mod_evasive have over mod_security2 in terms of DDOS protection?

I'm running an Apache2 server in front of a Tomcat and I need to implement a DDoS protection mechanism on the Apache2 layer. I have two candidates: mod_evasive and mod_security2 with the OWASP core ...
-3
votes
1answer
39 views

Is there a way on the server side to punish evil visitor? [closed]

For example an admin page that should not be visited unless with special cookie or query string token. The point being that anyone who tried and failed would likely be with bad intention. Or when the ...
0
votes
0answers
149 views

DDoS attack simulation using MININET

I´m developing some dynamic security policies using SDN, one of them consist in how the network should respond to a DDoS attack detection. So, I would like to test my policies but I'm having some ...
0
votes
0answers
155 views

server reached MaxClients setting, consider raising the MaxClients setting

this is my mod-status report. Do you think I could be under a DDOS attack? Thanks Current Time: Monday, 14-Oct-2013 18:56:57 CEST Restart Time: Monday, 14-Oct-2013 18:54:48 CEST Parent Server ...
0
votes
2answers
479 views

Apache DDOS Prevention

Moved from Stackoverflow. I have a LAMP server running Ubuntu with security programs such as Denyhosts, Fail2ban and with Mod_security installed but seem to constantly be the target of a DDOS attack. ...