A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
1answer
30 views

Possible DDoS (not sure). Cannot trace with netstat

I have a KVM node I'm running with only 7 VM instances. When GigE uplink port is enabled, server connection goes crazy hitting over 300MBps somehow. I cannot trace which IP is possibly being attacked, ...
0
votes
0answers
5 views

Am I under a DDoS attack? [migrated]

OK, so here's some info: Fedora23 running in VirtualBox on a Windows 7 Host. Public-facing router has no DMZ, but port forwarding from 2325 (external) to 1194 (internal) and the internal static IP. ...
-1
votes
2answers
43 views

How to count the number of SYN, ACK, or SYN-ACK in a second? [on hold]

I want to make a DDoS SYN Flood Detection, so i need to count the number of SYN, ACK, or SYN-ACK packet per second.
0
votes
1answer
65 views

Attempting to block “wordpress” useragent is overloading CPU [duplicate]

I've had some DDoS issues - specifically the XML-RPC exploit (wordpress) wherein thousands on thousands of Wordpress instances attack my machine. I have the following in my nginx server block: ...
-1
votes
1answer
34 views

Run shell script on the event of “possible SYN flooding”

Since it doesn't appear to be possible to get "netstat" stats at the time I got an SYN flooding, I'd like to write a script that gets all the stats I need (top IPs, used memory, etc) and write to a ...
0
votes
1answer
44 views

Handle “possible SYN flooding on port 443. Sending cookies.”

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast. However, the server appears to ...
0
votes
0answers
22 views

DDos attack on port 80 and limiting connection does not work [duplicate]

I have a Centos server running apache 2.4 and someone keeps connecting to the server causing http requests to timeout. I have searched the internet for answers to solve this problem and someone asked ...
13
votes
3answers
600 views

Dealing with NTP reflection attacks in IPTables

We're dealing with an NTP reflection / amplification attack at our colocated servers. This question is specific to responding to NTP reflection attacks, and not directed at DDoS in general. Here's ...
-4
votes
2answers
50 views

Does it make sense to have a server dedicated to login? [closed]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
0
votes
0answers
13 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
1
vote
1answer
40 views

CentOS 7 machine lost connectivity after DDoS attack [closed]

We were testing the DDoS protection of a CentOS 7 machine but after it ended, the connection on the machine is just gone. The configuration of the connection is exactly identical to before the DDoS ...
0
votes
0answers
32 views

Alghough TCP SYN Backlog size is set to 128 but in practical it is limited to 16

as you know in ubuntu, tcp syn backlog size is 128 by default. i tried to syn flood my ubuntu linux by hping3. to do that, i send 100 spoofed tcp syn packets per second to the ubuntu and meanwhile i ...
0
votes
2answers
53 views

DDOS Attack without Matching Virtual Hosts

I'm getting very weird kind of DDOS attacks, the server is flooded with requests however the problem is, when going through the access log, is im getting different requests to non-existent domains and ...
0
votes
1answer
31 views

Establishing TCP Connections by hping3

when a client sends 10 TCP SYN packets by hping3(not spoofing), server responds and sends 10 TCP SYN+ACK packets. now client should answer to server and Establish the connection by sending 10 ACK ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
9
votes
2answers
1k views

Is it possible to have a secondary managed DNS provider to quickly delegate to when DDOS attack on our *primary* external DNS provider happens?

So our DNS provider, every so often, experiences DDOS attacks on their systems that causes our front-facing web sites to go down. What are some options in terms of reducing dependency on a SINGLE ...
-1
votes
1answer
34 views

How can I only allow TCP connections for 1 port using iptables on Unbantu? How can I also set a maximum packet on a connection?

I'm running a server for public. I just want to allow TCP connections and I want to limit the packet to prevent ddosing a bit and setting a maximum IP/new connections per seconds with iptables. How ...
0
votes
1answer
27 views

Solid way to set up DDoS protection for a SaaS with many customer domains

I will be launching a SaaS soon. Customers will be able to sign up and get their own 'space'. Each customer will get a generated sub domain plus they can add their own custom domain if they wish too. ...
1
vote
0answers
30 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
1answer
68 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
1
vote
0answers
50 views

Using a VPS as front end proxy

I run a shell host that many users share which gets frequently DDoS'd (at least once every other month). So I have come up with a plan to peer all traffic with a VPS, so that it appears to everyone ...
-1
votes
2answers
37 views

Fallback between datacenters

What is the best way to do a fallback between datacenters. We have a dedicated server in one of the data centers and as our traffic increased i wanted to add more then backup i wanted redundancy and ...
0
votes
2answers
99 views

I'm trying to stress test a site but no hosting company will let me. What can I do?

We need to know what to expect if a rogue actor DDOSes one of our production sites, so I'm looking to spin up a few VPSes with web apps on so that I can simulate a DDOS against them with an online ...
0
votes
0answers
12 views

Ofbiz Ubuntu Server Vulnerability [duplicate]

My EC2 Instance is running ubuntu 14.04 and apache ofbiz-14.02. I found a python file was uploaded to server in ofbiz installation folder which I highly suspect it is the fraud by ofbiz which allowed ...
1
vote
0answers
44 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
35 views

nginx stub status SPIKES “writing” for a few seconds, causing 504 error. Why?! Bad VPS neighbour?

I am using Apache and nginx as reverse proxy, with php5-fpm. The latest week we've been receiving the following error in nginx's error.log: upstream timed out (110 connection timed out) while reading ...
-2
votes
1answer
133 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
0
votes
0answers
115 views

nginx req limit & fail2ban & cloudflare large attacks

I started to use as the topic says nginx with req limit + fail2ban + cloudflare. If someone exceeds the requests on any php file the ip gets blocked over the cloudflare api in the "ip firewall" on ...
0
votes
0answers
18 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
1
vote
2answers
18 views

Quantifying site response in case of DOS/DDOS attack tests

Let us say that we need to test a HTTPS web site for vulnerability/response in case of DOS/DDOS attacks. Among other tools, we can use GoldenEye for this purpose. We can vary the number of workers ...
-4
votes
2answers
130 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
0
votes
1answer
20 views

Preventing IP address from hitting Apache Tomcat by configuring Apache

We got Tomcat that needs to be restarted quite often on our production. Examining Apache access log file, I can see that certain IP addresses are hitting same logon page hundreds of times one after ...
0
votes
1answer
36 views

how to block access for RSS Feed using htaccess

My website is experiencing RSS Feed problem I get this htaccess code Order deny,allow Deny from all Allow from xx.xx.xx.xx but it blocks all IP address i just need to block mywebsite.com/feed.php ...
-2
votes
1answer
65 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
102 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
1
vote
1answer
240 views

DDOS mitigation of GCE

I am hoping to start shared hosting service on Google Compute Engine. Does the Google infrastructure have any DDOS mitigation built-in? This article here says it does. "Compute Engine makes use of ...
0
votes
0answers
12 views

Digital Ocean locked my droplet saying it was compromised and participating in ddos. How can I look into this? [duplicate]

I have a digital ocean droplet and I got a support ticket sent to me saying they've had to lock my droplet because it was flooding their network, assuming it has been compromised and performing ddos ...
0
votes
0answers
42 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
0
votes
1answer
64 views

Wrodpress DDOS /xmlrpc.php

This is what my nginx access.log looks like as I write this times infinity: 127.0.0.1 - - [19/Jan/2016:00:59:36 -0500] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; ...
2
votes
3answers
108 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. .....
0
votes
0answers
27 views

Clinet-side solutions to prevent DNS amplification without rate limiting on an open DNS server? [duplicate]

Are there alternative ways to operate an open/forwarding DNS server, without having to use rate limiting or other means of traffic inspection to prevent being used for DNS amplification attacks? ...
-1
votes
1answer
93 views

DDos attack ToS Violation - Outbound DoS [duplicate]

Fount ddos attack on ubuntu server netstat -nputw given outout Local Address Foreign Address State PID/Program name 55.57.72.37:59792 123.166.137.95:25000 SYN_SENT 2890/...
0
votes
0answers
32 views

How to monitor AWS EC2 instance in order to recognise DDOS and identify bottlenecks? [duplicate]

I have web app (NodeJs) running on AWS EC2 Ubuntu instance. I would like to monitor it somehow so I would be able to quickly recognise DDOS attacks. I would also like to identify bottlenecks etc. What ...
0
votes
1answer
416 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
1
vote
2answers
161 views

Protecting private IP address using Google for Work's SMTP settings

We currently got a website that is protected with cloudflare, however there is one leak we found. Our server's IP is shown in email headers, which makes cloudflare kinda useless at this point. We've ...
-1
votes
2answers
77 views

AWS DNS DDoS mitigation

I have an AWS server that is currently under DDoS via DNS amplification. I've setup CloudWatch logs for the VPC ACL and it's logging an enormous amount of rejected DNS traffic. Despite that traffic ...
0
votes
0answers
153 views

I can DDOS my server with one client by doing ctrl+F5

First of all I really don't know where I should start my investigation. I'll post the configuration files as soon as you'll ask. The server is windows 2008 R2 with Apache 2.4.9 and PHP 5.6. on a VM, ...
0
votes
0answers
59 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
0answers
52 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
0
votes
0answers
46 views

nginx deny POST requests to the index route

i recently noticed DDos-like attacks on my server and now i'm in charge of trying to reduce the damage they deal. They aren't that heavy, but it's enough for the poor performance my server delivers. ...