A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
9 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
-1
votes
0answers
5 views

What is the optimal (best) value for PORTFLOOD in CSF firewall? [duplicate]

What is the optimal value or best value for PORTFLOOD in CSF firewall. This setting is for shared hosting environment, where we have hosted 100s of small websites. Mainly we want to prevent it from ...
0
votes
1answer
14 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
0
votes
0answers
37 views

We're getting a lot of strange requests to our server [duplicate]

we recently started getting a lot of strange requests to our server, and it can't handle it. Some examples from our access log: 120.198.243.34 - - [16/Feb/2015:10:26:02 +0100] "GET ...
0
votes
1answer
26 views

Email Virus initiating a DOS Attack [duplicate]

I have a VPS that keeps getting shut down because of excessive inbound or outbound traffic. I thought I had a virus on my server and with it shut down so was my email server. So I got a new VPS ...
2
votes
1answer
31 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
0
votes
2answers
134 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
0
votes
1answer
40 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
0
votes
1answer
36 views

Content Redirection Attack on a Server

I'm working with an apache 2.2 server that is receiving lots of requests for content that does not exist on the server (edit: the specific content request changes frequently). It appears to be an ...
-1
votes
1answer
38 views

Are Google Apps implicitly DDoS protected?

Especially when talking about Google's Project Shield, people refer to an "internal anti-DDoS infrastructure". I could not find any more detailed information on such thing, and if it spans all the ...
0
votes
0answers
27 views

Suddenly many requests to /announce on server [duplicate]

We currently receive a lot of unusual requests on our Apache2 web server which impair the server's performance. Most requests go to /announce and /announce.php. Both addresses do not exist - 404. Here ...
0
votes
0answers
99 views

Using an Ubuntu VPS as a firewall/router

I have a dedicated server running ubuntu 12.04 hosting several websites and other applications which require client IP's to be visible, however the main dedicated server does not have DDoS protection, ...
0
votes
1answer
117 views

How to AVOID getting caught in a DDOS meant for someone else (not prevent)?

So we have a load balancer and all that jazz set up with Rackspace. However, guess what, our clients' websites were down again today. It seems that Rackspace should have their load-balancer ...
5
votes
2answers
118 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
1
vote
2answers
181 views

Setup alternative DNS entry while DNSimple is down for DDoS?

Have an app on Heroku with domains registered with DNSimple. DNSimple is undergoing DDoS for hours. (Sharing the naked heroku URLs with users is almost workable, but not an option as the OAuth ...
0
votes
1answer
118 views

How can I block traffic FROM Amazon Technologies Inc. (possible DDOS attack) [closed]

I've a small website (portfolio) and I usually notice traffic of about 10-20MB per day. But for few recent days I've noticed about 10-15GB (1000 times more) each day for 4 days now (and it continue ...
1
vote
0answers
30 views

Multiple pearl processess all hitting one IP address DDOS source hack? [duplicate]

I have been running at high CPU loads 45 45 45 ish for a while, updated cpanel / apache so far but tracing PID's that are running I find the following all with the same IP.. [code] select(8, [3], ...
0
votes
0answers
88 views

My VPS send an outbound attack

My VPS was sending an large outbound attack 10MB/s. It's normal max 300Kb/s I've tried searching around the internet, look for some /tmp folder, installed Linux Malware Detect, installed csf with ...
0
votes
0answers
54 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
0
votes
1answer
72 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
0
votes
1answer
138 views

GRE Tunnel in CentOS

How to create a GRE Tunnel in CentOS pointing all connections to server A for the server B? I have a public server with DDoS protection and need to use this as a firewall to filter acess to the other ...
0
votes
2answers
41 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
1answer
99 views

Can I block inbound traffic from a certain ISP

The problem My server keeps getting DDoS attacks from IP's belonging to Ecatel in The Netherlands. I wrote them a month ago and still haven't heard anything, and keep blocking individual IP addresses ...
0
votes
0answers
726 views

Apache Server 2.4 on EC2 “caught SIGTERM shutting down ”

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down: [Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] ...
0
votes
0answers
54 views

Recommended values for DIPR configuration on a web-server

Microsoft has this great module for IIS server: The Dynamic IP Restrictions (DIPR) module for IIS 7.0 and above provides protection against denial of service and brute force attacks on web ...
-1
votes
2answers
257 views

Block incoming traffic from unresolved IP address

How can I block all the incoming traffic from unresolved IP addresses? I am using CentOS with WHM/cPanel installed. I am getting huge junk traffic and 95% is from unresolved IP addresses and only 5% ...
0
votes
1answer
51 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
1
vote
1answer
102 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
0
votes
1answer
91 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
0
votes
1answer
91 views

Lots of connections to loopback, could be slowing us down

I'm trying to debug a sudden increase in our load average. I looked at this page to see if we were being DDoS'ed but the standout IP address was the loopback address: $ netstat -ntu | awk '{print ...
0
votes
0answers
101 views

Is it DDOS attack?

For three successive days, now, I'm having four or five unique servers' queries being denied by my csf firewall, which are renamed in the following extract I got from my log as "www.example1.com", ...
0
votes
1answer
466 views

.htaccess rules to stop DDoS POST flooding

We're under a distributed denial of service attack from traffic that looks like this: 49.146.161.175 - - [11/Jul/2014:00:43:42 -0400] "POST / HTTP/1.1" 500 557 "-" "Mozilla/4.0 (compatible; MSIE 6.0; ...
1
vote
2answers
214 views

blocking udp attack ip with iptables [duplicate]

I was trying to block an ip of ( network stresser tool - a ddos websites selling ddos bots by seconds online ) the first one i was trying to block with iptables : iptables -A INPUT -d 173.193.26.73 ...
1
vote
2answers
214 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
1
vote
3answers
154 views

Does CloudFlare make a site a greater potential DDOS target?

CloudFlare has gotten a lot of press recently as protecting businesses from DDOS attacks. But from looking at their twitter feed, it looks like they are targeted every day, and large segments of their ...
1
vote
3answers
696 views

My webserver is getting flooded with invalid requests

My webserver (nginx) keeps getting requests like this: 23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET ...
0
votes
1answer
180 views

iptables connection limit does not work on debian [duplicate]

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
0
votes
1answer
360 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
1
vote
2answers
78 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
-1
votes
2answers
197 views

Is it possible to prevent DDoS attacks? [closed]

I recently read that certain industries—including the one I work in—are more likely than others to be targeted by a DDoS attack. Can you give me some tips on how to prevent DDoS attacks?
1
vote
0answers
341 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
578 views

High outbound network traffic on Tomcat under process nodeJR [duplicate]

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...
1
vote
0answers
55 views

Multiple DDOS protection interfaces merging on one TS server

The problem I have is I have 3 DDOS protection interfaces from a multi homed DDOS protection solution and teamspeak is refusing to return packets via the correct interface (aka the one that sent it ...
0
votes
0answers
286 views

Apache2 php-cgi processes, how to limit them?

I have a 32gig ram dedicated server running on Ubuntu 12.04 with ISPConfig / Apache configuration. The thing is, anyone can take the site down simply by holding down F5 button for 20 seconds causing ...
2
votes
1answer
409 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
0
votes
1answer
1k views

Apache logs flooded with connections - “(via ggpht.com GoogleImageProxy)”

My server was running on 100% CPU and looking at the Apache logs I saw hundreds of thousands of connections that looked like this: 10.190.45.31 - - [13/Mar/2014:15:29:02 +0000] "GET SOMETHING ...
-1
votes
1answer
400 views

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea ...
-1
votes
1answer
64 views

How to tell if the server was down because of DDoS of another reason?

my server was down for a couple of hours during the night. i see in the cpu load monitoring in the amazon AWS console that it was 100% load. also, the network in jumped (but no that dramatically) so ...
4
votes
2answers
102 views

Will MX records with a longer TTL help mitigate effects of DoS attack? [duplicate]

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
1
vote
1answer
87 views

Apache MySQL Server Crashing - Large number of connections from localhost

I'm running a 2GB Centos 5.9 server with the standard LAMP setup. I'm running a wordpress website so it's nothing to demanding performance wise. However the MySQL server seems to keep crashing as I ...