A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
15 views

“eth0: link up” kernel panick on debian - DDoS attack or soft / device issue

A few hours ago my dedicated machine in Hetzner went down. I was thinking what that was DDoS attack, or Hetzner network problem. But my other machine was working fine. So i loggined into Hetzner and ...
-6
votes
0answers
24 views

Ease of DDoS'ing Alexa rank 50 site? [on hold]

Let's say I wanted to DDoS a site with a world popularity rating (Alexa) of ~50 (say, BBC). Would it be possible using only a low-powered laptop and a medium speed fibre broadband connection? Also, ...
-2
votes
0answers
25 views

Dos Attack Server python java [duplicate]

I dont know what is going on on my server. RamNode just adviced me that my VPS appears to e sending out DoS attacks. I restarted the server and did htop and found this: gyazo
0
votes
0answers
28 views

Blocking Low-bandwith layer 7 attack [on hold]

Lately I have been experencing Layer 7 bandwith attacks on my server running centos 6.6 16 gigs of ram. These attacks cause mysql tro skyrocket to 500-600% The requests are as followed. ...
-3
votes
0answers
24 views

how to block specify request nginx [closed]

Need block Nginx (no BAN) specify get requests: example: +http://corp.sputnik.ru/webmaster)" 95.167.189.69 - - [20/Mar/2015:07:32:36 +0100] "GET ...
0
votes
1answer
50 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
-1
votes
0answers
49 views

Servers running SOCAT crashing [closed]

I host a series of servers however a number of them are under constant DDOS attacks. These attacks are easily mitigated through a system I have created with a high level of success. The system is a ...
1
vote
1answer
25 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
0
votes
0answers
33 views

How can node addition/substraction be done while keeping randomness in their connections in a P2P unstructured network?

If a unstructured P2P network that uses an admission mechanism for new peers entrance gets completely offline because of a massive attack (e.g. massive DDoS), after reconnecting, peers will try to ...
0
votes
0answers
10 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
0
votes
1answer
15 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
0
votes
0answers
37 views

We're getting a lot of strange requests to our server [duplicate]

we recently started getting a lot of strange requests to our server, and it can't handle it. Some examples from our access log: 120.198.243.34 - - [16/Feb/2015:10:26:02 +0100] "GET ...
0
votes
1answer
35 views

Email Virus initiating a DOS Attack [duplicate]

I have a VPS that keeps getting shut down because of excessive inbound or outbound traffic. I thought I had a virus on my server and with it shut down so was my email server. So I got a new VPS ...
2
votes
1answer
31 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
0
votes
2answers
166 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
1answer
44 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
0
votes
1answer
38 views

Content Redirection Attack on a Server

I'm working with an apache 2.2 server that is receiving lots of requests for content that does not exist on the server (edit: the specific content request changes frequently). It appears to be an ...
-1
votes
1answer
47 views

Are Google Apps implicitly DDoS protected?

Especially when talking about Google's Project Shield, people refer to an "internal anti-DDoS infrastructure". I could not find any more detailed information on such thing, and if it spans all the ...
0
votes
0answers
27 views

Suddenly many requests to /announce on server [duplicate]

We currently receive a lot of unusual requests on our Apache2 web server which impair the server's performance. Most requests go to /announce and /announce.php. Both addresses do not exist - 404. Here ...
0
votes
0answers
123 views

Using an Ubuntu VPS as a firewall/router

I have a dedicated server running ubuntu 12.04 hosting several websites and other applications which require client IP's to be visible, however the main dedicated server does not have DDoS protection, ...
0
votes
1answer
126 views

How to AVOID getting caught in a DDOS meant for someone else (not prevent)?

So we have a load balancer and all that jazz set up with Rackspace. However, guess what, our clients' websites were down again today. It seems that Rackspace should have their load-balancer ...
5
votes
2answers
131 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
1
vote
2answers
196 views

Setup alternative DNS entry while DNSimple is down for DDoS?

Have an app on Heroku with domains registered with DNSimple. DNSimple is undergoing DDoS for hours. (Sharing the naked heroku URLs with users is almost workable, but not an option as the OAuth ...
0
votes
1answer
177 views

How can I block traffic FROM Amazon Technologies Inc. (possible DDOS attack) [closed]

I've a small website (portfolio) and I usually notice traffic of about 10-20MB per day. But for few recent days I've noticed about 10-15GB (1000 times more) each day for 4 days now (and it continue ...
1
vote
0answers
30 views

Multiple pearl processess all hitting one IP address DDOS source hack? [duplicate]

I have been running at high CPU loads 45 45 45 ish for a while, updated cpanel / apache so far but tracing PID's that are running I find the following all with the same IP.. [code] select(8, [3], ...
0
votes
0answers
104 views

My VPS send an outbound attack

My VPS was sending an large outbound attack 10MB/s. It's normal max 300Kb/s I've tried searching around the internet, look for some /tmp folder, installed Linux Malware Detect, installed csf with ...
0
votes
0answers
61 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
0
votes
1answer
79 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
0
votes
1answer
165 views

GRE Tunnel in CentOS

How to create a GRE Tunnel in CentOS pointing all connections to server A for the server B? I have a public server with DDoS protection and need to use this as a firewall to filter acess to the other ...
0
votes
2answers
45 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
1answer
108 views

Can I block inbound traffic from a certain ISP

The problem My server keeps getting DDoS attacks from IP's belonging to Ecatel in The Netherlands. I wrote them a month ago and still haven't heard anything, and keep blocking individual IP addresses ...
0
votes
0answers
802 views

Apache Server 2.4 on EC2 “caught SIGTERM shutting down ”

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down: [Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] ...
0
votes
0answers
57 views

Recommended values for DIPR configuration on a web-server

Microsoft has this great module for IIS server: The Dynamic IP Restrictions (DIPR) module for IIS 7.0 and above provides protection against denial of service and brute force attacks on web ...
-1
votes
2answers
274 views

Block incoming traffic from unresolved IP address

How can I block all the incoming traffic from unresolved IP addresses? I am using CentOS with WHM/cPanel installed. I am getting huge junk traffic and 95% is from unresolved IP addresses and only 5% ...
0
votes
1answer
54 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
1
vote
1answer
108 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
0
votes
1answer
99 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
0
votes
1answer
96 views

Lots of connections to loopback, could be slowing us down

I'm trying to debug a sudden increase in our load average. I looked at this page to see if we were being DDoS'ed but the standout IP address was the loopback address: $ netstat -ntu | awk '{print ...
0
votes
0answers
105 views

Is it DDOS attack?

For three successive days, now, I'm having four or five unique servers' queries being denied by my csf firewall, which are renamed in the following extract I got from my log as "www.example1.com", ...
0
votes
1answer
500 views

.htaccess rules to stop DDoS POST flooding

We're under a distributed denial of service attack from traffic that looks like this: 49.146.161.175 - - [11/Jul/2014:00:43:42 -0400] "POST / HTTP/1.1" 500 557 "-" "Mozilla/4.0 (compatible; MSIE 6.0; ...
1
vote
2answers
230 views

blocking udp attack ip with iptables [duplicate]

I was trying to block an ip of ( network stresser tool - a ddos websites selling ddos bots by seconds online ) the first one i was trying to block with iptables : iptables -A INPUT -d 173.193.26.73 ...
1
vote
2answers
230 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
1
vote
3answers
160 views

Does CloudFlare make a site a greater potential DDOS target?

CloudFlare has gotten a lot of press recently as protecting businesses from DDOS attacks. But from looking at their twitter feed, it looks like they are targeted every day, and large segments of their ...
1
vote
3answers
781 views

My webserver is getting flooded with invalid requests

My webserver (nginx) keeps getting requests like this: 23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET ...
0
votes
1answer
195 views

iptables connection limit does not work on debian [duplicate]

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
0
votes
1answer
374 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
1
vote
2answers
93 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
-1
votes
2answers
214 views

Is it possible to prevent DDoS attacks? [closed]

I recently read that certain industries—including the one I work in—are more likely than others to be targeted by a DDoS attack. Can you give me some tips on how to prevent DDoS attacks?
1
vote
0answers
353 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
578 views

High outbound network traffic on Tomcat under process nodeJR [duplicate]

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...