A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
0
votes
1answer
28 views
IPTables : prevent UDP Flooding
I want to stop the UDP flooding on the Linux device.
I have written a simple IPTable rule to drop all UDP packets
iptables -A INPUT -p udp DROP
But still the DoS attack happens and the device gets ...
0
votes
0answers
11 views
Amazon EC2 NetworkOutMetrics alarm causes?
After switching my instance to m3.xlarge, I noticed this spike in network traffic (both in and out (NetworkOut >= 2.0E7 for 5 minutes)). I was running Wireshark just to monitor traffic at this time, ...
1
vote
3answers
47 views
Tools for simulating DDoS attacks
I wanted to test my website if it can sustain strong DDoS's, but I don't know which tools could I use to simulate them in my website. What tools are used to simulate DDoS?
I found bonesi but it was ...
-1
votes
0answers
21 views
Been disconnected by host for allegedly hosting a DDoS script. How to identify? [duplicate]
I have a 1and1 VPS, which is apparently being used to DDoS other servers maliciously.
As a result, 1and1 have cut it off. Seems sensible.
They tell me they will reconnect it once I have shown ...
-2
votes
0answers
25 views
(D)DoS attack from my server [duplicate]
My hoster has just disconnected my vserver from the network as a DoS attack is allegedly coming from it. It is an Ubuntu 8.04 server with Plesk 9.0 installed.
How can I check if someone uses my ...
1
vote
1answer
81 views
+100
Outlook for Mac, Active Directory DNS and DDOS
I'm not a Mac user, nor the Windows Admin, so forgive me if I don't have the
the nomenclature correct, but I'm trying to help another admin.
We run Active Directory and Exchange 2010. The name ...
1
vote
1answer
40 views
can I filter TCP SYN packets with seq=0
My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs.
Packets look like this:
IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0
with ...
1
vote
0answers
42 views
Mitigate DDoS attack by Null-routing my server's IP?
My services were attacked by what appears to be a botnet of quite a large number of computers. Since all my servers have additional IPs, and my hosting provider lets me null-route my IP addresses to ...
0
votes
1answer
54 views
Prevent DNS responses for specific domain completely
Situation:
Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-1
votes
1answer
33 views
Can the netstat command show what specific website a user is on? [closed]
I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I ...
0
votes
3answers
59 views
Can you block an ip with multiple connections? (Apache ddos attack)
My server is under a Apache ddos attack right now. There's a ton of single ip addresses with 30+ connections.
When I use this SSH command:
netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk ...
-1
votes
2answers
41 views
Router DDoS Protection by MAC
I was wondering if there are any DDoS defences where a (any) router will block all packets (for any period of time) from the MAC address of its attacker. If so, under what circumstances would this ...
3
votes
0answers
64 views
How to prevent HTTP-based DDoS attacks
This night, I've noticed nginx was not responding to requests. After some investigation, I found that it was using 100% of the CPU and error.log was full of messages like this one:
2013/05/28 ...
-1
votes
1answer
31 views
Send mails from secondary server
Problem:
When I send an email from my server, the email headers contain the IP address of the server.
Yeah, this is a problem, because the server is being the target of DDoS attacks. Using CloudFlare ...
0
votes
0answers
43 views
Analyzing server-status
We have been monitoring our server-status on our apache2 server and have been noticing lots of '.' connections (open slot with no current process) from the same IP: 178.101.111.90.
They are all ...
0
votes
1answer
58 views
Ubuntu Server DDoS protection
I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
0answers
73 views
How to protect Nginx from HULK DoS tool
There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
0
votes
0answers
22 views
How can I stop a GGP-3 packet attack on a Cisco ASA firewall?
I have recently been having trouble with my server being attacked and so I was advised to get a Cisco firewall installed, which I did, this seemed to help for a while but now I have noticed that on ...
1
vote
1answer
88 views
Nginx - Redirect request by GET parameters pattern
One of my servers was attacked by DDoS a couple of days ago and it lasted for 4 days. Below are the logs snippet of the request:
36.224.180.253 - - [14/May/2013:03:11:46 +0800] "GET ...
3
votes
1answer
68 views
Traffic backlogged after (D)DoS attack? [closed]
About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down.
I raced over to my server room, where my TP-Link router was completely unresponsive ...
0
votes
1answer
73 views
How to configure mod_reqtimeout in Apache2
I need to configure mod_reqtimeout in my Apache server v2.2.22 (in a linux machine). Problem is, I have absolutely no clue on how to do it.
I checked the Apache site on this module at this link but ...
0
votes
1answer
57 views
How to block an IP, if it is making many http/apache/mysql requests in a second?
If some one tried force burst attack on my website, how can i block their IP address?
I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
3
votes
1answer
102 views
Windows server 2008, a very small DDoS is able to kill my server
So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
0
votes
1answer
70 views
Anti-DDos Apache2 Fail2ban regex rule
I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong.
Request which i like to ban look like this:
186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
52 views
Parse Apache logfile and ban IPs
My server is under attack, it is flooded with request with the following pattern:
Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
-1
votes
1answer
129 views
Any way to Improve performance of iptables DDOS whitelist? [closed]
I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
2answers
76 views
How to properly drop ICMP type 3 packets on possible DDoS attack?
Even after running
iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP
I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:
19:41:31.923630 IP ...
-3
votes
1answer
271 views
Determining the source of a SYN_flood given a file on cloudShark [closed]
I'm having trouble determining the IP's associated with a SYN-flood style ddos attack carried out on a system. How can i determine which ips are the culprits? i initially looked for SYN -> SYN, ACK ...
0
votes
0answers
53 views
ICMP time exceeded in-transit
In the last few days my server suffers an attack of this kind:
(bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs)
tcpdump -n proto ICMP
17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
1answer
53 views
Find IP addresses with most connections on system
I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface).
Is it possible ...
0
votes
2answers
61 views
Will I get banned or blocked for running a diagnostic app?
This may seem like a simple question. Hopefully it will have a simple answer.
I run an internet radio station. There are 3 machines.
Music source client
Stage server
Master server (relays the ...
0
votes
1answer
44 views
Lot of Apache requests in “L” state, what could be the reason? DDOS?
I am having this in my apache server status message:
LLLLLLLLLLLLLLLWLLLLLLLLWLLLLLWLLLLLLLLLLWLLLLLLLWLLLLLLLLLLLLLL
WLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLWLWLLLLLLLLL
...
0
votes
3answers
185 views
iptables rule to stop DDOS
My server is undergoing a ddos attack with the traffic in my apache logs appearing like:
ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer"
ip ...
0
votes
3answers
200 views
I think I'm under DoS attack. How can I respond?
My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
0answers
98 views
Block incoming DNS queries using netsh advfirewall
How do you do this with Windows firewall?
iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP
Ideally, if you can do this with netsh and so that it will survive whatever it is that ...
0
votes
0answers
107 views
Is my server under attack? Many Sleep in processlist & Many Sending Replay Status in Apache
I have website as a forum using PHPBB visitors around 40,000 per day.
I'm not sure my site is under attacked or not, here is the clue.
There is an error "Too many connection" throughout the day. So ...
3
votes
1answer
55 views
iptables, what to open on INPUT for wget
I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
0
votes
1answer
39 views
ssyn.c and slow.c used on my VPS [duplicate]
I have noticed some changes on VPS Debian Squeeze and looked with history to see what commands were run. Then I found some which I'm 100% sure I didn't run because I don't know what are they. Somebody ...
0
votes
1answer
58 views
Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center
I have a non-Xen VPS (don't exactly know what the software is).
The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
1answer
72 views
Cisco ACL Block by Packet Length
I am presently blocking a small scale DDOS attack using IP addresses but all the packets are the same size, 1514 bits and I kind of don't want to fill up an ACL rule with a bunch of IPs. After reading ...
0
votes
2answers
197 views
Detect process that is doing an outbound DDoS attack [duplicate]
My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the ...
2
votes
1answer
259 views
How do I drop “empty” HTTP packets using iptables?
I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
0
votes
2answers
271 views
How to disable access to DNS server from internet, leaving intranet intact? Using iptables
I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
14
votes
4answers
1k views
How is it possible for the Root Name Servers to handle all DNS requests?
I was reading about DNS some days ago and learned how the requests are processed.
If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
0answers
251 views
netstat -anp No PID/Program name? [closed]
I am newbie to this,Could someone help ?
I didn't see any PID/PROGRAM name on some process, what could that be the reason ?
# netstat -anp
Active Internet connections (servers and established)
...
0
votes
0answers
134 views
DDos Mitigation Tips for a Game Server
I am looking foward on building a scablable pipe (proxy) ddos protection for my game servers's on amazon. I got some ideas, could anyone please review them? Here they are.
My idea is to do something ...
0
votes
2answers
117 views
netfilter ip_conntrack and (d)DoS
Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse?
I know it adds the ability to track connections and such but just curious if it helps ...
2
votes
1answer
188 views
Spoofed DDoS protection strategy, filter window size == 0?
I was hit by a SYN flood that nearly killed the network stack of my ipvs loadbalancer (80K packets/sec). The "ksoftirqd" process took 100% CPU, the machine was nearly unresponsive from the network. A ...
0
votes
1answer
175 views
Countermeasures versus incoming DNS reflection attack
i am currently experiencing a DNS reflection attack towards my server.
I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for:
02:53:57.626156 IP (tos ...
-2
votes
2answers
226 views
Determine packets per second [closed]
What is an ideal way to get the number of packets per second on a Linux box?
Would I use tcpdump or are there better methods?
