A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

-1
votes
1answer
25 views

How to prevent password bruteforce in web application?

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
13 views

Forwarding Ports?

Is it possible to turn a server into a full proxy tunnel regardless of protocol? Like, say I have server A which has DDoS protection and server B that doesn't. Only thing is server B has higher ...
0
votes
0answers
21 views

Filtering KVM guests with IPtables

My partner has a server with OVH that receives a constant variety of ddos attacks, while still staying up. We want to use IPtables on the host to filter the guests VM's traffic. The guest VM we want ...
-1
votes
0answers
26 views

How do I visually analyze/check DDOS attacks? [on hold]

How do I tell that a DDOS attack is happening on my servers? Is there a tool which provides visual cues to figure out what is happening or which IP is causing trouble, which IP to block. A simple ...
-2
votes
0answers
19 views
-1
votes
1answer
41 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
-5
votes
0answers
30 views

Block All Connections Not From CloudFlare [duplicate]

I have a simple request. I would like to only allow traffic to my server from cloudflare. My website is being pounded by attacks, and there is no legit reason someone should be making a connection to ...
1
vote
2answers
98 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...
-1
votes
0answers
24 views

How to stop SYN RECV Flood?

I currently am under SYN_Flood (see picture) and I simply do not know how I can protect me from . I already SYN cookies enabled on the server . What can I do else? Because of that attack my server ...
2
votes
0answers
59 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
1
vote
1answer
48 views

IPTABLES block User-Agent

I get DDoS by the Wordpress Pingback BOTNET, now I want to block all client who contain Wordpress in there Useragents. For example: WordPress/4.0; http://vk.lokos.net; verifying pingback from ...
2
votes
0answers
24 views

How to enable SYN Cookies on Debian 7.5? [migrated]

How do I enable SYN Cookies on Debian 7.5? nano /etc/sysctl.conf #net.ipv4.tcp_syncookies = 1 remove here the # sysctl -p service network restart Is that the correct way? Or what must I look ...
0
votes
0answers
47 views

Make NGINX Block All Requests To Direct Server IP - Stop XML-RPC Attacks

Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help. Any assistance would be greatly appreciated :)! ...
0
votes
1answer
48 views

DOS and DDOS attacks [closed]

Our website is being constantly attacked by the bots. We tried mod_evasive and mode_security but those modules slowed our server considerably. Can anybody please suggest more solutions. Thanks in ...
2
votes
0answers
32 views

Getting DDoSed with requests for links to other sites and Bittorrent and BingBar [duplicate]

The other day my server started getting slow and the logs showed it was being heavily spammed with strange requests like for BingBar, 218.94.73.210 - - [22/Apr/2015:13:25:37 +1200] "GET ...
1
vote
0answers
51 views

Kernel panic under DDOS

I'm running a Debian 6 - 64bit system (Kernel 2.6.32-5-amd64) and often get flooded with DDOS. I have tuned the network parameters under /etc/sysctl.conf to not let any kernel parameter overflow. ...
-1
votes
2answers
47 views

IPTables not blocking IPStresser [closed]

I have been trying four days to block DDoS attacks with no success. I want to block anything that isn't whitelisted. This is my idea on OS Centos 7: //Delete All Existing Rules iptables --flush ...
1
vote
1answer
33 views

what would be the Impact of using Multiple sites in same VPC on AWS platform?

I have a site running on four server inside of a VPC on aws platform. My question is would their be any impact on site if I host another website on four new server in the same VPC considering their ...
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
1answer
43 views

How to block ApacheBench from sending requests to server?

I'm using Ubuntu 14.10, Apache 2.4. My server is under a huge DDoS attack right now, I tried to use mod_security , fail2ban and blocking attacking IPs manually using iptables and nothing worked. The ...
0
votes
1answer
69 views

How to defense a DDoS powered by end user's browser?

Like what Github.com has just experienced, what if a script provider, such as google ads, google analysis or something similar, add a malicious scripts at the end of their script, and let end users ...
0
votes
3answers
78 views

What is the most effective way to block IP address in Application Layer?

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
0
votes
0answers
32 views

“eth0: link up” kernel panick on debian - DDoS attack or soft / device issue

A few hours ago my dedicated machine in Hetzner went down. I was thinking what that was DDoS attack, or Hetzner network problem. But my other machine was working fine. So i loggined into Hetzner and ...
0
votes
1answer
132 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
1
vote
1answer
46 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
0
votes
0answers
33 views

How can node addition/substraction be done while keeping randomness in their connections in a P2P unstructured network?

If a unstructured P2P network that uses an admission mechanism for new peers entrance gets completely offline because of a massive attack (e.g. massive DDoS), after reconnecting, peers will try to ...
0
votes
1answer
19 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
0
votes
1answer
18 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
0
votes
0answers
37 views

We're getting a lot of strange requests to our server [duplicate]

we recently started getting a lot of strange requests to our server, and it can't handle it. Some examples from our access log: 120.198.243.34 - - [16/Feb/2015:10:26:02 +0100] "GET ...
0
votes
1answer
41 views

Email Virus initiating a DOS Attack [duplicate]

I have a VPS that keeps getting shut down because of excessive inbound or outbound traffic. I thought I had a virus on my server and with it shut down so was my email server. So I got a new VPS ...
2
votes
1answer
36 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
0
votes
2answers
218 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
1answer
56 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
0
votes
1answer
41 views

Content Redirection Attack on a Server

I'm working with an apache 2.2 server that is receiving lots of requests for content that does not exist on the server (edit: the specific content request changes frequently). It appears to be an ...
-1
votes
1answer
60 views

Are Google Apps implicitly DDoS protected?

Especially when talking about Google's Project Shield, people refer to an "internal anti-DDoS infrastructure". I could not find any more detailed information on such thing, and if it spans all the ...
0
votes
0answers
28 views

Suddenly many requests to /announce on server [duplicate]

We currently receive a lot of unusual requests on our Apache2 web server which impair the server's performance. Most requests go to /announce and /announce.php. Both addresses do not exist - 404. Here ...
0
votes
0answers
168 views

Using an Ubuntu VPS as a firewall/router

I have a dedicated server running ubuntu 12.04 hosting several websites and other applications which require client IP's to be visible, however the main dedicated server does not have DDoS protection, ...
0
votes
1answer
136 views

How to AVOID getting caught in a DDOS meant for someone else (not prevent)?

So we have a load balancer and all that jazz set up with Rackspace. However, guess what, our clients' websites were down again today. It seems that Rackspace should have their load-balancer ...
5
votes
2answers
154 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
1
vote
2answers
214 views

Setup alternative DNS entry while DNSimple is down for DDoS?

Have an app on Heroku with domains registered with DNSimple. DNSimple is undergoing DDoS for hours. (Sharing the naked heroku URLs with users is almost workable, but not an option as the OAuth ...
0
votes
1answer
714 views

How can I block traffic FROM Amazon Technologies Inc. (possible DDOS attack) [closed]

I've a small website (portfolio) and I usually notice traffic of about 10-20MB per day. But for few recent days I've noticed about 10-15GB (1000 times more) each day for 4 days now (and it continue ...
1
vote
0answers
30 views

Multiple pearl processess all hitting one IP address DDOS source hack? [duplicate]

I have been running at high CPU loads 45 45 45 ish for a while, updated cpanel / apache so far but tracing PID's that are running I find the following all with the same IP.. [code] select(8, [3], ...
0
votes
0answers
142 views

My VPS send an outbound attack

My VPS was sending an large outbound attack 10MB/s. It's normal max 300Kb/s I've tried searching around the internet, look for some /tmp folder, installed Linux Malware Detect, installed csf with ...
0
votes
0answers
66 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
0
votes
1answer
92 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
0
votes
1answer
208 views

GRE Tunnel in CentOS

How to create a GRE Tunnel in CentOS pointing all connections to server A for the server B? I have a public server with DDoS protection and need to use this as a firewall to filter acess to the other ...
0
votes
2answers
45 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
1answer
126 views

Can I block inbound traffic from a certain ISP

The problem My server keeps getting DDoS attacks from IP's belonging to Ecatel in The Netherlands. I wrote them a month ago and still haven't heard anything, and keep blocking individual IP addresses ...
0
votes
0answers
978 views

Apache Server 2.4 on EC2 “caught SIGTERM shutting down ”

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down: [Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] ...
0
votes
0answers
65 views

Recommended values for DIPR configuration on a web-server

Microsoft has this great module for IIS server: The Dynamic IP Restrictions (DIPR) module for IIS 7.0 and above provides protection against denial of service and brute force attacks on web ...