A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
11 views

Block connection through proxy in firewall [duplicate]

I'm getting some 'ddos' on my Linux machine (ubuntu 14.04 64bit). I have a lot of connections from IP which are proxy IP's (like tor), on specific port. Question: How to block all proxy connections ...
-3
votes
0answers
30 views

Redirect IP to another IP [closed]

My domain redirects to my Teamspeak 3 Server on port 9987, and it works perfectly. But now I will add a second server to block DDoS so I must redirect my domain to server #1 and server #1 must ...
1
vote
2answers
47 views

High inbound and outbound network traffic

Over the last day or so, one of instances has had a large amount of bandwidth consumed. This means that we have nearly exceeded our allowance (roughly the same amount inbound and outbound). Looking ...
-1
votes
1answer
34 views

Linux DDOS Protection / Gateway without NAT

I need help to configure a box for DDOS protection and provide external ip addresses to "internal" (which aren't really internal) servers. I have 32 IP addresses from my ISP. I want to configure a ...
0
votes
0answers
32 views

Use extra firewall to filter WAN traffic before reaching UTM?

I am running a simple web server behind UTM, only port 80,443 is open. However almost 80% of the traffic coming through WAN is trouble. Mostly are port scanners / sniffers or systematically querying ...
0
votes
1answer
47 views

Blocking ddos string with iptables [duplicate]

I want to ask how do block spefic packet payload? 14:46:35.837759 IP 145.92.16.14.27017 > x.27030: UDP, length 25 0x0000: 4500 0035 44a4 0000 ee11 53ae 915c 100e E..5D.....S..\.. ...
1
vote
0answers
84 views

Exim SMTP reverse proxy

This is my first post on Serverfault, so if I make some mistakes, please let me know. The issue that I'm dealing with right now is a DDoS attack on my Exim mailserver (cPanel) on port 25. From what I ...
0
votes
2answers
60 views

How to secure Windows Server 2012 R2 against “open recursive resolver” attack

I received an email from an ISP stating that our server had participated in a DDOS attack against one of their servers--and that we appear to be running an "open recursive resolver". The IP address ...
0
votes
0answers
38 views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: ...
0
votes
1answer
55 views

DDOS prevention/mitigation on Linux CentOs server using IP tables

One of our servers has generated a 19Gb access.log in the space of about 24 hours and the server went down in this time. We'd like to implement some measures to safeguard against DDOS attacks but ...
0
votes
0answers
58 views

mod_evasive can't be installed: “undefined symbol: evasive24_module”

I wanted to protect my Apache/2.4.6 (CentOS) server in CentoOS 7 from DDOS attacks so after searching for some alternatives I found this page. They go through the installation of the modules evasive ...
0
votes
0answers
33 views

limit_req on nginx not working

Iam using Ubuntu server 14.04 with apache + nginx proxy over it. I tried to set up limit_req in /etc/nginx-sp/nginx-sp.conf as this: http { limit_req_zone $binary_remote_addr zone=one:1m ...
0
votes
1answer
122 views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
2
votes
1answer
72 views

Protecting against a DOS attack

Someone is DOSing my server. It is not a DDOS attack as there is only one server involved in this attack. I simply put following iptable rule to drop all the packets coming from the attacker: ...
-3
votes
2answers
67 views

block or log IPs that direct access my website (ubuntu , nginx)

The website is under DDOS, the cloud service is doing a pretty good job for a cost of dozen bugs a month. We are happy! However the attackers have been hitting our site with IP. Currently, we 301 ...
-1
votes
1answer
129 views

How to stop small DDOS attacks (443 port)?

On the server goes DDoS attack. ~# netstat -n -p | awk '{print $5}'|awk -F: '{print $1}' | sort -n | uniq -c | sort -nr | head -n10 48 109.229.9.53 47 31.207.244.130 45 87.252.227.83 ...
-1
votes
1answer
43 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
41 views

Filtering KVM guests with IPtables

My partner has a server with OVH that receives a constant variety of ddos attacks, while still staying up. We want to use IPtables on the host to filter the guests VM's traffic. The guest VM we want ...
-1
votes
1answer
82 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
1
vote
2answers
140 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...
2
votes
0answers
90 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
1
vote
1answer
264 views

IPTABLES block User-Agent

I get DDoS by the Wordpress Pingback BOTNET, now I want to block all client who contain Wordpress in there Useragents. For example: WordPress/4.0; http://vk.lokos.net; verifying pingback from ...
0
votes
0answers
179 views

Make NGINX Block All Requests To Direct Server IP - Stop XML-RPC Attacks

Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help. Any assistance would be greatly appreciated :)! ...
0
votes
1answer
88 views

DOS and DDOS attacks [closed]

Our website is being constantly attacked by the bots. We tried mod_evasive and mode_security but those modules slowed our server considerably. Can anybody please suggest more solutions. Thanks in ...
2
votes
0answers
32 views

Getting DDoSed with requests for links to other sites and Bittorrent and BingBar [duplicate]

The other day my server started getting slow and the logs showed it was being heavily spammed with strange requests like for BingBar, 218.94.73.210 - - [22/Apr/2015:13:25:37 +1200] "GET ...
1
vote
0answers
64 views

Kernel panic under DDOS

I'm running a Debian 6 - 64bit system (Kernel 2.6.32-5-amd64) and often get flooded with DDOS. I have tuned the network parameters under /etc/sysctl.conf to not let any kernel parameter overflow. ...
-1
votes
2answers
79 views

IPTables not blocking IPStresser [closed]

I have been trying four days to block DDoS attacks with no success. I want to block anything that isn't whitelisted. This is my idea on OS Centos 7: //Delete All Existing Rules iptables --flush ...
1
vote
1answer
37 views

what would be the Impact of using Multiple sites in same VPC on AWS platform?

I have a site running on four server inside of a VPC on aws platform. My question is would their be any impact on site if I host another website on four new server in the same VPC considering their ...
0
votes
0answers
20 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
1answer
100 views

How to block ApacheBench from sending requests to server?

I'm using Ubuntu 14.10, Apache 2.4. My server is under a huge DDoS attack right now, I tried to use mod_security , fail2ban and blocking attacking IPs manually using iptables and nothing worked. The ...
0
votes
1answer
83 views

How to defense a DDoS powered by end user's browser?

Like what Github.com has just experienced, what if a script provider, such as google ads, google analysis or something similar, add a malicious scripts at the end of their script, and let end users ...
0
votes
3answers
114 views

What is the most effective way to block IP address in Application Layer?

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
0
votes
0answers
43 views

“eth0: link up” kernel panick on debian - DDoS attack or soft / device issue

A few hours ago my dedicated machine in Hetzner went down. I was thinking what that was DDoS attack, or Hetzner network problem. But my other machine was working fine. So i loggined into Hetzner and ...
0
votes
1answer
183 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
1
vote
1answer
97 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
0
votes
0answers
33 views

How can node addition/substraction be done while keeping randomness in their connections in a P2P unstructured network?

If a unstructured P2P network that uses an admission mechanism for new peers entrance gets completely offline because of a massive attack (e.g. massive DDoS), after reconnecting, peers will try to ...
0
votes
1answer
31 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
0
votes
1answer
39 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
0
votes
0answers
37 views

We're getting a lot of strange requests to our server [duplicate]

we recently started getting a lot of strange requests to our server, and it can't handle it. Some examples from our access log: 120.198.243.34 - - [16/Feb/2015:10:26:02 +0100] "GET ...
0
votes
1answer
47 views

Email Virus initiating a DOS Attack [duplicate]

I have a VPS that keeps getting shut down because of excessive inbound or outbound traffic. I thought I had a virus on my server and with it shut down so was my email server. So I got a new VPS ...
2
votes
1answer
56 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
0
votes
2answers
286 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
1answer
94 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
0
votes
1answer
53 views

Content Redirection Attack on a Server

I'm working with an apache 2.2 server that is receiving lots of requests for content that does not exist on the server (edit: the specific content request changes frequently). It appears to be an ...
-1
votes
1answer
83 views

Are Google Apps implicitly DDoS protected?

Especially when talking about Google's Project Shield, people refer to an "internal anti-DDoS infrastructure". I could not find any more detailed information on such thing, and if it spans all the ...
0
votes
0answers
28 views

Suddenly many requests to /announce on server [duplicate]

We currently receive a lot of unusual requests on our Apache2 web server which impair the server's performance. Most requests go to /announce and /announce.php. Both addresses do not exist - 404. Here ...
0
votes
0answers
204 views

Using an Ubuntu VPS as a firewall/router

I have a dedicated server running ubuntu 12.04 hosting several websites and other applications which require client IP's to be visible, however the main dedicated server does not have DDoS protection, ...
0
votes
1answer
169 views

How to AVOID getting caught in a DDOS meant for someone else (not prevent)?

So we have a load balancer and all that jazz set up with Rackspace. However, guess what, our clients' websites were down again today. It seems that Rackspace should have their load-balancer ...
5
votes
2answers
195 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
1
vote
2answers
250 views

Setup alternative DNS entry while DNSimple is down for DDoS?

Have an app on Heroku with domains registered with DNSimple. DNSimple is undergoing DDoS for hours. (Sharing the naked heroku URLs with users is almost workable, but not an option as the OAuth ...