A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

-1
votes
0answers
27 views

Is code 444 DDoS-safe?

Can I DDoS a site which repsonses with a 444 code? It is like a nullroute via IPtables? I want to restrict access via my IP, but not via my domain (because its secured by CloudFlare, the IP actually ...
-4
votes
0answers
17 views

How to Protect your site fro Brute Force Attack [on hold]

I am facing problem in hosting of Zubidubi.com.In starting website is going quite good but in last days site is blocked by hosting provider.They are saying that your site is using more CPU Usage upto ...
0
votes
0answers
11 views

Digital Ocean locked my droplet saying it was compromised and participating in ddos. How can I look into this? [duplicate]

I have a digital ocean droplet and I got a support ticket sent to me saying they've had to lock my droplet because it was flooding their network, assuming it has been compromised and performing ddos ...
-7
votes
0answers
31 views

Fight back DDOS attack [closed]

Do DDOS packets have valid source ip address? I mean, a routable IP address? So, the attacking IP can be reached back? If so, maybe we could fight DDOSers with the same DDOS tactics, but doing it ...
0
votes
0answers
20 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
0
votes
1answer
36 views

Wrodpress DDOS /xmlrpc.php

This is what my nginx access.log looks like as I write this times infinity: 127.0.0.1 - - [19/Jan/2016:00:59:36 -0500] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; ...
2
votes
3answers
64 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. ...
0
votes
0answers
27 views

Clinet-side solutions to prevent DNS amplification without rate limiting on an open DNS server? [duplicate]

Are there alternative ways to operate an open/forwarding DNS server, without having to use rate limiting or other means of traffic inspection to prevent being used for DNS amplification attacks? ...
-1
votes
1answer
31 views

DDos attack ToS Violation - Outbound DoS [duplicate]

Fount ddos attack on ubuntu server netstat -nputw given outout Local Address Foreign Address State PID/Program name 55.57.72.37:59792 123.166.137.95:25000 SYN_SENT ...
0
votes
0answers
31 views

How to monitor AWS EC2 instance in order to recognise DDOS and identify bottlenecks? [duplicate]

I have web app (NodeJs) running on AWS EC2 Ubuntu instance. I would like to monitor it somehow so I would be able to quickly recognise DDOS attacks. I would also like to identify bottlenecks etc. What ...
0
votes
1answer
124 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
1
vote
2answers
61 views

Protecting private IP address using Google for Work's SMTP settings

We currently got a website that is protected with cloudflare, however there is one leak we found. Our server's IP is shown in email headers, which makes cloudflare kinda useless at this point. We've ...
-1
votes
2answers
54 views

AWS DNS DDoS mitigation

I have an AWS server that is currently under DDoS via DNS amplification. I've setup CloudWatch logs for the VPC ACL and it's logging an enormous amount of rejected DNS traffic. Despite that traffic ...
0
votes
0answers
60 views

I can DDOS my server with one client by doing ctrl+F5

First of all I really don't know where I should start my investigation. I'll post the configuration files as soon as you'll ask. The server is windows 2008 R2 with Apache 2.4.9 and PHP 5.6. on a VM, ...
0
votes
0answers
23 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
0answers
33 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
0
votes
0answers
34 views

nginx deny POST requests to the index route

i recently noticed DDos-like attacks on my server and now i'm in charge of trying to reduce the damage they deal. They aren't that heavy, but it's enough for the poor performance my server delivers. ...
0
votes
0answers
15 views

Massive DDoS hitting my VPS, no idea what to do [duplicate]

for the past few days there has been a massive amount of connections hitting my VPS. I am not sure whether my VPS is actually being attacked or just being used for DDoSing someone else's server. ...
0
votes
0answers
159 views

many graceful restarts in httpd error log?

Our server was down , and we restatred the services (nginx & httpd), and when i look at the logs, i've found these lines , there are so many Graceful restart requested, doing restart lines, whats ...
0
votes
1answer
43 views

How do black holes mitigate ddos attacks?

I'm looking at how to try and prevent DDOS attacks before I launch a website as I will expect lots of online 'booters' to attack the server. I've read through lots of threads on here and ...
0
votes
0answers
10 views

How to block fake googlebots with haproxy? [duplicate]

We want to block all requests coming from non google ips but identify as a bot from google.
1
vote
2answers
102 views

block fake google bots [duplicate]

How could I block DDOS attacks with fake Google bots? I found 2 solutions on the net. But both seems to block also correct google bots. # Block fake google when it's not coming from their IP range's ...
1
vote
0answers
76 views

Drop first packet for every IP with iptables

My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets. Is there a way to drop the first packet received ...
0
votes
1answer
36 views

Should I expect reception of packets in hping3 --flood?

I'm testing a newly purchased VPS for DDoS vulnerability using hping3. If I do not use --flood, everything goes fine and I see close to 0% packet loss every time. But If I do use --flood, then the ...
0
votes
0answers
47 views

Php5-cgi, 503 error or DDoS attack?

I am trying to figure out if these things are connected. Until yesterday I had some CPU/RAM spikes on random times that could last for hours/days all connected with 30-40 php5-cgi processes being run ...
1
vote
0answers
28 views

Simple anti DDoS protection in FreeBSD [duplicate]

I have a lot of request from data centers to my web server on FreeBSD and sometimes it've have a lot of performance problem with my web projects. Adding to IPFW list all IP's data centers is ...
-1
votes
1answer
52 views

I think I am getting ddos-ed, have I taken proper precautions? [closed]

I noticed my SQL server was down on my wordpress website, 2 days ago. I couldn't figure out why I wasn't able to restart the SQL server so I looked at my logs. I noticed this one IP was hitting my ...
0
votes
1answer
199 views

NGINX not responding during DDoS attacks

I'm going to get straight to the point, NGINX doesn't seem to handle any HTTP requests during a DDoS attack using XML-RPC. The server only uses about 1% of the CPU during an XML-RPC DDoS attack. The ...
0
votes
1answer
75 views

Nginx limit_conn inheritance

I am trying to protect Drupal running on Nginx from simple DDoS with limit_conn and limit_req. But I encountered some strange behavior with inheritance of limit_conn directive which I cannot explain. ...
0
votes
0answers
68 views

How to prevent outgoing UDP flood

I've been googling for hours now but can't find a sure or helpful answer. I need to disable high-volume outgoing UDP from my server. I'm trying to configure APF because of the RAB functionality, but ...
1
vote
1answer
336 views

Firewall UDP Flood Dos/DDoS

Recently I have been suffering from what appears to be a UDP query flood attack. I am looking for a way to block the attack using a software firewall such as iptables, this should be possible, as ...
0
votes
0answers
13 views

Block connection through proxy in firewall [duplicate]

I'm getting some 'ddos' on my Linux machine (ubuntu 14.04 64bit). I have a lot of connections from IP which are proxy IP's (like tor), on specific port. Question: How to block all proxy connections ...
1
vote
2answers
102 views

High inbound and outbound network traffic

Over the last day or so, one of instances has had a large amount of bandwidth consumed. This means that we have nearly exceeded our allowance (roughly the same amount inbound and outbound). Looking ...
-1
votes
1answer
74 views

Linux DDOS Protection / Gateway without NAT

I need help to configure a box for DDOS protection and provide external ip addresses to "internal" (which aren't really internal) servers. I have 32 IP addresses from my ISP. I want to configure a ...
0
votes
0answers
49 views

Use extra firewall to filter WAN traffic before reaching UTM?

I am running a simple web server behind UTM, only port 80,443 is open. However almost 80% of the traffic coming through WAN is trouble. Mostly are port scanners / sniffers or systematically querying ...
0
votes
1answer
116 views

Blocking ddos string with iptables [duplicate]

I want to ask how do block spefic packet payload? 14:46:35.837759 IP 145.92.16.14.27017 > x.27030: UDP, length 25 0x0000: 4500 0035 44a4 0000 ee11 53ae 915c 100e E..5D.....S..\.. ...
1
vote
1answer
247 views

Exim SMTP reverse proxy [closed]

This is my first post on Serverfault, so if I make some mistakes, please let me know. The issue that I'm dealing with right now is a DDoS attack on my Exim mailserver (cPanel) on port 25. From what I ...
0
votes
2answers
458 views

How to secure Windows Server 2012 R2 against “open recursive resolver” attack

I received an email from an ISP stating that our server had participated in a DDOS attack against one of their servers--and that we appear to be running an "open recursive resolver". The IP address ...
1
vote
2answers
279 views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: ...
1
vote
1answer
382 views

DDOS prevention/mitigation on Linux CentOs server using IP tables

One of our servers has generated a 19Gb access.log in the space of about 24 hours and the server went down in this time. We'd like to implement some measures to safeguard against DDOS attacks but ...
0
votes
0answers
115 views

mod_evasive can't be installed: “undefined symbol: evasive24_module”

I wanted to protect my Apache/2.4.6 (CentOS) server in CentoOS 7 from DDOS attacks so after searching for some alternatives I found this page. They go through the installation of the modules evasive ...
0
votes
0answers
85 views

limit_req on nginx not working

Iam using Ubuntu server 14.04 with apache + nginx proxy over it. I tried to set up limit_req in /etc/nginx-sp/nginx-sp.conf as this: http { limit_req_zone $binary_remote_addr zone=one:1m ...
0
votes
1answer
282 views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
2
votes
1answer
85 views

Protecting against a DOS attack

Someone is DOSing my server. It is not a DDOS attack as there is only one server involved in this attack. I simply put following iptable rule to drop all the packets coming from the attacker: ...
-3
votes
2answers
114 views

block or log IPs that direct access my website (ubuntu , nginx)

The website is under DDOS, the cloud service is doing a pretty good job for a cost of dozen bugs a month. We are happy! However the attackers have been hitting our site with IP. Currently, we 301 ...
-1
votes
1answer
274 views

How to stop small DDOS attacks (443 port)?

On the server goes DDoS attack. ~# netstat -n -p | awk '{print $5}'|awk -F: '{print $1}' | sort -n | uniq -c | sort -nr | head -n10 48 109.229.9.53 47 31.207.244.130 45 87.252.227.83 ...
-1
votes
1answer
47 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
74 views

Filtering KVM guests with IPtables

My partner has a server with OVH that receives a constant variety of ddos attacks, while still staying up. We want to use IPtables on the host to filter the guests VM's traffic. The guest VM we want ...
-1
votes
1answer
138 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
1
vote
2answers
149 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...