A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

80
votes
1answer
4k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
18
votes
5answers
20k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
14
votes
4answers
1k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
13
votes
9answers
5k views

Public Facing Recursive DNS Servers - iptables rules

We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks? The ...
13
votes
2answers
1k views

Has anyone got billed for malicious activities (DDoS) on a cloud server?

I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues? Thank you!
12
votes
1answer
2k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
12
votes
3answers
672 views

DNS down in Anonymous attack

As I'm writing this our company website and the web-service we developed are down in the big GoDaddy outage resulting from an Anonymous attack (or so says Twitter). We used GoDaddy as our registrar ...
10
votes
9answers
30k views

Server under DDOS attack - How to find out IPs?

My server is under DDOS attacks and I want to block the IP that is doing it, what logs should I be looking for to determine the attacker's IP?
10
votes
1answer
947 views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
9
votes
2answers
1k views

Site has been under a massive DDOS attack for 5 weeks now

One of my sites has been getting attacked for over 5 weeks. Im currently employing serverorigin.com proxy services to fight it, since doing it on the server proved to be futile. They tell me that the ...
8
votes
3answers
884 views

RedStation.com is heaven for ddos attackers, How to file complaint? [closed]

Sorry, I don't know where to open this subject. This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
8
votes
8answers
14k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
8
votes
6answers
608 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
8
votes
7answers
6k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
6
votes
5answers
1k views

DDoS Protection Services - are they good enough? [duplicate]

first of all, I understand that it's better to have DDoS protections on data center level. But our DC is not ready to provide good quality of protection. So we thinking about using some external DDoS ...
5
votes
3answers
2k views

DDOS using ntp server

I've heard about new kind of DDOS where ntp is used for reflection . My questions are really simple : Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose ...
5
votes
3answers
259 views

Correct way to handle security threats to web server on budget [closed]

During our annual security review I was reminded of an incident earlier this year where we received a threat to our organizations web server. It was over a organization policy and threatened to DDoS ...
5
votes
4answers
2k views

Mitigate DDoS attack with HAProxy [duplicate]

We were targeted earlier today by a DDoS attack. There was 20x as many connections as normal on our load balancer (HAProxy), and all the backend nodes continued to go down during this attack. System ...
5
votes
3answers
1k views

How can I block a specific type of DDoS attack?

My site is being attacked and is using up all the RAM. I looked at the Apache logs and every malicious hit seems to simply be a POST request on /, which is never required by a normal user. So I ...
5
votes
2answers
150 views

DDoS attack case study - Korean election watchdog's site [closed]

Is it possible to break only some of a web site services using DDoS? For example, disabling only the search feature of a specific website. I raise this question following a controversy in South ...
5
votes
1answer
101 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
4
votes
5answers
1k views

My server was reported to hoster abuse to perform ddos attacks. What should I do?

I do not see anything suspicious on the server (no netstat connections to remote 80 port), but I'm not a professional server admin (I'm a hardcore software developer). Please do not write obvious ...
4
votes
2answers
498 views

Is it possible to find the actual source IP of a packet with a spoofed IP header?

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
4
votes
3answers
755 views

100mb/s upgrade to 1gbps network - To Prevent DDOS [duplicate]

I have been under constant DDOS attack the last couple of weeks. Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages. I run ...
4
votes
2answers
737 views

Web site kills hard disk I/O, how to prevent?

The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
4
votes
2answers
7k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
4
votes
6answers
2k views

How to survive anonymous DDOS attack? [duplicate]

Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional. I read (basic theory) about dealing with normal DDOS ...
4
votes
2answers
328 views

How to prevent DDoS attacks? [duplicate]

I am a creator of a flash game server. I use cloudflare for my site, however the game tcp server cant be protected by CloudFlare. For about 2 months some person DDoSes my game using direct ip. Every ...
4
votes
5answers
2k views

How can I defend against a DRDoS exploiting NTP server on an ESXi host?

Recently, we had some problems with one of our ESXi servers, caused by the NTP Server DRDoS Amplification Attack using ntpdc. How do I configure the NTP server on ESXi to not be exposed to this DDoS ...
4
votes
2answers
6k views

How Can I Harden the TCP/IP Stack in Windows Server 2008? [duplicate]

I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks. There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
4
votes
1answer
188 views

Windows server 2008, a very small DDoS is able to kill my server

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
4
votes
1answer
433 views

Block outgoing LOIC attacks in a network

I am admin of a small network. Users in our network have access to internet through a squid NAT server. Recently, we have detected that some users are using LOIC to attack servers on the internet. ...
4
votes
2answers
2k views

SYN Flood Advice

Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a ...
4
votes
2answers
862 views

DDOS attack - How to prevent [duplicate]

Recently I read about Denial of Service attack on Amazon & PayPal. I am curious that how this is performed. These big companies must have huge servers, so DOS would require billions of bots to ...
4
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
4
votes
2answers
901 views

DDoS and Heroku [duplicate]

I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do?
3
votes
7answers
614 views

DDOS Attack Victim - How much to Admit - Opinion Question

Here's the environment: Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so Many Clients pay to use the site ...
3
votes
3answers
438 views

Can't stop DDOS [duplicate]

I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it. (1gbs is the maximum speed of the server.) I've the following iptables rules: ...
3
votes
4answers
2k views

Amazon EC2 bandwidth charges in case of unwanted incoming traffic(ddos/flood)?

What happens if my EC2 instance gets ddosed/flooded, which could potentially go up to tens of gigabytes an hour(and even more) of undesired incoming traffic, will i be charged for this traffic? My ...
3
votes
1answer
6k views

How can I detect a DDoS attack using pfSense so I can tell my ISP who to block? [duplicate]

Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host. I understand (from this ...
3
votes
6answers
9k views

How long do DDoS attacks last? [duplicate]

I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last? Just trying to get an idea of how long we'll have to ...
3
votes
2answers
132 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a ...
3
votes
2answers
986 views

Can DDoS be stopped with BGP? [duplicate]

When I am experiencing DDoS @10Gbps, if I have BGP router with 10M table entries in it, can I perform search on the offensive network? I would do this the way, that first I would remove routing to me ...
3
votes
5answers
2k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
3
votes
2answers
247 views

What amount of effort and money should one invest against DDoS threats? [closed]

Typically, when you invest money to protect yourself against some possible threat, you should take into account two factors: the probability (p) of the problem actually happening how much money (m) ...
3
votes
3answers
393 views

Anti-DDoS Question [duplicate]

Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have ...
3
votes
3answers
596 views

Could this be a DOS attack?

I'm a bit out of me league here (we're a reasonably small firm, I'm a software dev stuck with doing sysadmin when needed), but I thought I'd ask the smart people at ServerFault about my problem before ...
3
votes
2answers
283 views

Is it possible to distinguish from “good” http requests and DoS attacks?

How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?