The ddos tag has no wiki summary.
0
votes
2answers
38 views
Locating Source of Inbound DDOS
Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS.
Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec).
In the ...
-2
votes
0answers
54 views
Configure Windows 7 and Ubuntu firewall to prevent LOIC or HOIC attacks [closed]
My laptop is connected most of the time to college network, and I want to keep my laptop safe from LOIC attacks without having to monitor any suspicious activities from any of the IP on the network. ...
2
votes
0answers
39 views
My server is used for DDoS attacks [migrated]
I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?
What logs should I look to, is there any settings I can modify so such ...
0
votes
1answer
73 views
(D)DOS Deflate Bug/Alternative
Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
0
votes
1answer
101 views
Configuring Wireshark for Rolling Captures during DDoS Attack
We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
137 views
How to find the connection time-out value in linux?
I am setting up a nginx webserver with php-fpm and (d)dos deflate to ban attacks.
Now currently there is no traffic to my server at all, as i'm testing things.
With this command i can see who is ...
1
vote
3answers
76 views
DDOS Deflate Safe Connection Limit?
I work for a site that often get's attacked by bot networks. We have started to use this tool: http://deflate.medialayer.com/ which auto-bans ip's that have more open connections than the set value. ...
0
votes
1answer
32 views
Very often database PostgreSQL for my webapp fails
I have web application like
Nginx (proxy) + Tomcat (backend) + PostgreSQL (database).
This web application is located on amazon free tier instance (http://aws.amazon.com/free/) and very often from ...
1
vote
2answers
85 views
DoS attack simulation vs real deal
There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be.
What are the key differences between real vs ...
3
votes
2answers
183 views
Stop DoS attacks with an IP tables rule?
I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule?
By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
4answers
93 views
How to set up notifications about server overload? [closed]
Possible Duplicate:
What tool do you use to monitor your servers?
How to get notified (preferably by email) when my webserver reaches certain amount of incoming requests? This way I'll be ...
2
votes
2answers
68 views
Resolving a prolonged DDoS
I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
4answers
131 views
Apache getting DDoS
My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
3
votes
2answers
340 views
How can I prevent a DDOS attack on Amazon EC2?
One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
2
votes
1answer
133 views
Packet flooding, is there any way to handle it?
My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
4
votes
1answer
300 views
Web site kills hard disk I/O, how to prevent?
The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
1
vote
2answers
81 views
Software vs. Hardware Appliance DDOS & Firewalls
I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables.
I'm evaluating my security options and was wondering how well ...
0
votes
2answers
115 views
VPS under DDoS Attacks [closed]
Possible Duplicate:
Am I getting DDoSed, and what should I about it?
I'm using a 2 VPS Servers.
My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
5
votes
2answers
96 views
DDoS attack case study - Korean election watchdog's site [closed]
Is it possible to break only some of a web site services using DDoS?
For example, disabling only the search feature of a specific website.
I raise this question following a controversy in South ...
0
votes
0answers
46 views
Change nginx settings automatically, when server load increases
I have a server running Debian, and periodically it gets weak DDoS attacks.
Usually it's enough to stricken nginx config like setting up limit_req, but it gives normal users trouble viewing image ...
0
votes
1answer
84 views
Cloudflare performance, ddos
I have been using cloudflare CDN on my website (wordpress) for about 4 months, mostly because I was hoping the CDN would make things faster, and make the load on my cheap server somewhat smaller, ...
0
votes
0answers
78 views
How to track down a direct traffic spike of IE8/9 user agents
Got a weird issue that I'm coming up empty on. The past few days (since before Thanksgiving) I'm getting a large traffic spike accessing a specific page, which is a subsection index that doesn't ...
2
votes
2answers
191 views
DoS attack requesting single file on server, best way to overcome?
My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!).
Sample from the access log:
186.92.86.149 - - ...
0
votes
1answer
47 views
Blocking all RIPE Addresses in Server 2008?
Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, ...
0
votes
1answer
51 views
Diagnosing DDOS after the fact
I manage the code and deployments for an ASP.net site on a dedicated server. Windows 2008-64 R2, 8GB RAM, Dual Core. It is a dedicated intranet site that never has much traffic. Most of the ...
0
votes
2answers
163 views
DNS Server Spoofed Request Amplification DDoS - Prevention
I've been conducting security scans, and a new one popped up for me:
DNS Server Spoofed Request Amplification DDoS
The remote DNS server answers to any request. It is possible to query
the ...
3
votes
6answers
493 views
How to survive anonymous DDOS attack?
Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional.
I read (basic theory) about dealing with normal DDOS ...
1
vote
2answers
45 views
Concerns about a Dedicated (Windows Server 2008) + DDoS
I am have today a dedicated server with these specs:
Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3
And I would like to know what are the best ...
0
votes
3answers
70 views
Small unsustained ddos?
Recently, I have random occurence where I can't reach my server. When this occurs, about 1 ping on each 10 manage to ping back. The ping that do get through are within normal response time (about 42ms ...
4
votes
1answer
166 views
Block outgoing LOIC attacks in a network
I am admin of a small network. Users in our network have access to internet through a squid NAT server.
Recently, we have detected that some users are using LOIC to attack servers on the internet. ...
-1
votes
1answer
158 views
My Linux server is thought to be under a DDOS attack and no access to SSH - what to do? [closed]
How can I fix the issues from a DDOS attack without any SSH access at all.
My main domain is http://www.reddexservers.co.uk - is there any way of checking if it is under attack externally?
Thanks!
2
votes
4answers
181 views
mod_rewrite and access.log
My site recently came under a DOS attack, which seems to have been mostly fixed by installing mod-evasive (which is fine)
I wanted to find the IP which was used for the attack so naturally I went to ...
0
votes
2answers
93 views
IP Address filter 'before' http secured connections for protection against DDoS attacks?
One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an ...
3
votes
1answer
87 views
Only allow traffic on port 80 for only 1 IP address
We are currently going through a DDOS attack, and have outsourced DDOS mitigation to BlockDOS.net. Problem is they want me to block all port 80/443 traffic except from their IP address.
If I block ...
2
votes
1answer
183 views
How to block null/blank user-agents in IIS 7.5
We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.
Here ...
1
vote
1answer
141 views
What “Syn Proxy Servers” are recommended? Or how to build one?
My questions are:
1.) What is a recommended "SYN PROXY SERVER" to filter bogus SYN Attacks and only forward "handshaked" valid connections to the host behind it (to be protected). I search the term, ...
4
votes
5answers
424 views
My server was reported to hoster abuse to perform ddos attacks. What should I do?
I do not see anything suspicious on the server (no netstat connections to remote 80 port), but I'm not a professional server admin (I'm a hardcore software developer). Please do not write obvious ...
0
votes
3answers
765 views
Block All UDP traffic (to prevent ddos)
I have been receiving countless ddos attacks the last couple of weeks. Just now I caught one while I was running iptraf. Normally 99.9% of the packets used on my server are TCP packages, and not UDP. ...
4
votes
4answers
405 views
100mb/s upgrade to 1gbps network - To Prevent DDOS
I have been under constant DDOS attack the last couple of weeks.
Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages.
I run ...
0
votes
1answer
186 views
Multiple DDOS attacks per day
I run a popular tech website, and for weeks my site has been under DDOS attacks. The attacks happen at random times, and often about 10 times per day. Usually the attacks only last a few minutes, then ...
0
votes
1answer
105 views
Please, help with nginx! blocking requests with part url
Please, help! My site is under DDoS attack now.
Attackers load page: /?p={RANDOM_NUMBER}http://antijob.anho.org/
How to block all requests with it?
Trying:
location / {
if ( $args = '' ) {
...
0
votes
1answer
133 views
My website keeps being hit by iPhones…am I being DDOSed?
66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" ...
2
votes
3answers
385 views
Am I getting DDoSed, and what should I about it?
At the moment my server is lagging pretty bad, and it crashes.
It's a dedicated server which has run completely fine last two days.
What does this command do?
netstat -n|grep :80|cut -c 45-|cut -f 1 ...
1
vote
1answer
199 views
How to enable SYN cookies on windows server 2008?
I have a SYN spoofing attack on one of my servers. While there are enough resources available on server (BW, CPU, RAM), new legitimate requests get Request time-out error. It seems backlog queue gets ...
1
vote
3answers
86 views
Best software defense against a bandwidth SYN spoofing attack
This is a known DDoS attack. The case is about a Windows server 2008 enterprise edition.
Under attack peak, server's CPU reaches 60%, 50% of memory is still free and half of network card is utilized ...
0
votes
2answers
264 views
Solution for DDOS
My server is under DDoS attacks. I see my access log and get something:
968966 93-97-53-41.zone5.bethere.co.uk - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" ...
0
votes
3answers
104 views
Which steps to take to protect java server from cpu overload?
I've written a java server application for a software solution I'm fiddling with.
The server uses multithreading to handle sockets and postgresql as a database. I'm worried about potential ...
-3
votes
2answers
275 views
DDoS Mitigation with round robin DNS?
Alright, so my friend and I are setting up a new website. We expect heavy DDoS attacks, so our plan is to use nginx to proxy from various cloud servers so that people can't find our actual server's ...
3
votes
2answers
95 views
In what way am I more likely to be DDoS'd? Via http or other ports?
I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena.
The service will consist of:
a ...
2
votes
1answer
146 views
Stopping SYN DDoS Attack
One of my servers is under constant SYN DDoS attack. I have decided to setup fail2ban but as far as I can understand, that will only take care of the ssh login attacks. How can I stop these SYN DDoS ...
