A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
14
votes
4answers
1k views
How is it possible for the Root Name Servers to handle all DNS requests?
I was reading about DNS some days ago and learned how the requests are processed.
If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
14
votes
3answers
9k views
How can I prevent a DDOS attack on Amazon EC2?
One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
13
votes
2answers
855 views
Has anyone got billed for malicious activities (DDoS) on a cloud server?
I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues?
Thank you!
12
votes
9answers
2k views
Public Facing Recursive DNS Servers - iptables rules
We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks?
The ...
12
votes
3answers
599 views
DNS down in Anonymous attack
As I'm writing this our company website and the web-service we developed are down in the big GoDaddy outage resulting from an Anonymous attack (or so says Twitter).
We used GoDaddy as our registrar ...
9
votes
9answers
22k views
Server under DDOS attack - How to find out IPs?
My server is under DDOS attacks and I want to block the IP that is doing it, what logs should I be looking for to determine the attacker's IP?
9
votes
1answer
597 views
Amplified reflected attack on DNS servers
The term Amplified reflected attack is new to me, and I have a few questions about it.
I've heard it mostly happens with DNS servers - is that true?
How do you protect against it?
How do you know if ...
9
votes
2answers
1k views
Site has been under a massive DDOS attack for 5 weeks now
One of my sites has been getting attacked for over 5 weeks. Im currently employing serverorigin.com proxy services to fight it, since doing it on the server proved to be futile.
They tell me that the ...
8
votes
3answers
633 views
RedStation.com is heaven for ddos attackers, How to file complaint? [closed]
Sorry, I don't know where to open this subject.
This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
8
votes
6answers
523 views
ddos. Are we that helpless?
With recent DDOS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
8
votes
4answers
993 views
Stopping a DOS attack
One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
7
votes
6answers
2k views
lots of dns requests from China, should I worry?
I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address:
Apr 7 12:36:13 server17 named[26294]: client ...
7
votes
8answers
11k views
How to prevent a LOIC (DDOS) attack?
The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
6
votes
4answers
2k views
bind: blackhole for invalid recursive queries?
I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains.
Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
6
votes
5answers
1k views
DDoS Protection Services - are they good enough?
first of all, I understand that it's better to have DDoS protections on data center level. But our DC is not ready to provide good quality of protection. So we thinking about using some external DDoS ...
5
votes
4answers
1k views
Mitigate DDoS attack with HAProxy
We were targeted earlier today by a DDoS attack. There was 20x as many connections as normal on our load balancer (HAProxy), and all the backend nodes continued to go down during this attack.
System ...
5
votes
3answers
452 views
How can I block a specific type of DDoS attack?
My site is being attacked and is using up all the RAM. I looked at the Apache logs and every malicious hit seems to simply be a POST request on /, which is never required by a normal user.
So I ...
5
votes
2answers
141 views
DDoS attack case study - Korean election watchdog's site [closed]
Is it possible to break only some of a web site services using DDoS?
For example, disabling only the search feature of a specific website.
I raise this question following a controversy in South ...
4
votes
5answers
868 views
My server was reported to hoster abuse to perform ddos attacks. What should I do?
I do not see anything suspicious on the server (no netstat connections to remote 80 port), but I'm not a professional server admin (I'm a hardcore software developer). Please do not write obvious ...
4
votes
2answers
463 views
Is it possible to find the actual source IP of a packet with a spoofed IP header?
I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
4
votes
4answers
605 views
100mb/s upgrade to 1gbps network - To Prevent DDOS
I have been under constant DDOS attack the last couple of weeks.
Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages.
I run ...
4
votes
2answers
541 views
Web site kills hard disk I/O, how to prevent?
The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
4
votes
6answers
2k views
How to survive anonymous DDOS attack?
Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional.
I read (basic theory) about dealing with normal DDOS ...
4
votes
2answers
3k views
Stop DoS attacks with an IP tables rule?
I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule?
By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
4
votes
2answers
6k views
How Can I Harden the TCP/IP Stack in Windows Server 2008?
I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks.
There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
4
votes
1answer
343 views
Block outgoing LOIC attacks in a network
I am admin of a small network. Users in our network have access to internet through a squid NAT server.
Recently, we have detected that some users are using LOIC to attack servers on the internet. ...
4
votes
2answers
2k views
SYN Flood Advice
Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a ...
4
votes
2answers
699 views
DDOS attack - How to prevent
Recently I read about Denial of Service attack on Amazon & PayPal. I am curious that how this is performed. These big companies must have huge servers, so DOS would require billions of bots to ...
4
votes
1answer
601 views
measures to take against a dns amplification attack
I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing.
I took the ...
3
votes
7answers
549 views
DDOS Attack Victim - How much to Admit - Opinion Question
Here's the environment:
Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so
Many Clients pay to use the site ...
3
votes
6answers
5k views
How long do DDoS attacks last?
I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last?
Just trying to get an idea of how long we'll have to ...
3
votes
2answers
120 views
In what way am I more likely to be DDoS'd? Via http or other ports?
I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena.
The service will consist of:
a ...
3
votes
2answers
533 views
Can DDoS be stopped with BGP?
When I am experiencing DDoS @10Gbps, if I have BGP router with 10M table entries in it, can I perform search on the offensive network?
I would do this the way, that first I would remove routing to me ...
3
votes
1answer
3k views
How can I detect a DDoS attack using pfSense so I can tell my ISP who to block?
Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host.
I understand (from this ...
3
votes
5answers
2k views
Apache DDoS Protection in router (pFsense)
I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
3
votes
3answers
515 views
Could this be a DOS attack?
I'm a bit out of me league here (we're a reasonably small firm, I'm a software dev stuck with doing sysadmin when needed), but I thought I'd ask the smart people at ServerFault about my problem before ...
3
votes
2answers
278 views
Is it possible to distinguish from “good” http requests and DoS attacks?
How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?
3
votes
1answer
65 views
Traffic backlogged after (D)DoS attack? [closed]
About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down.
I raced over to my server room, where my TP-Link router was completely unresponsive ...
3
votes
1answer
51 views
iptables, what to open on INPUT for wget
I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
3
votes
1answer
187 views
iptables - drop all HTTP(S) traffic but from CloudFlare
I would like to allow only HTTP(S) traffic coming from CloudFlare. In that way attackers cannot attack the server directly.
I know CloudFlare is not mainly a DDoS mitigator, but I would like to try ...
3
votes
3answers
1k views
EC2 ELB and DOS attacks
I'm using Amazon's ELB to load balance between servers,
When my site is under attack by bots, everything is exhausted, so here is the problem
I can't block IP addresses with Amazon's security ...
3
votes
1answer
513 views
Only allow traffic on port 80 for only 1 IP address
We are currently going through a DDOS attack, and have outsourced DDOS mitigation to BlockDOS.net. Problem is they want me to block all port 80/443 traffic except from their IP address.
If I block ...
3
votes
1answer
92 views
Windows server 2008, a very small DDoS is able to kill my server
So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
3
votes
1answer
47 views
Perform action based on load avg
I'm running some web applications on an debian server and have to struggle with ddos attacks sometimes. It's eating up all my resources and I can't ssh anymore into the server.
An idea was to drop all ...
3
votes
1answer
426 views
Stopping SYN DDoS Attack
One of my servers is under constant SYN DDoS attack. I have decided to setup fail2ban but as far as I can understand, that will only take care of the ssh login attacks. How can I stop these SYN DDoS ...
3
votes
2answers
445 views
Ubuntu scalable nginx mongodb mongdb memcached server configuration
I have been building a PHP web application using the following techniques in the past 2 months:
PHP 5.3.4
MongoDB
MySql
I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
3
votes
2answers
761 views
How to block null/blank user-agents in IIS 7.5
We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.
Here ...
3
votes
2answers
691 views
DDoS and Heroku
I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do?
2
votes
3answers
684 views
Am I getting DDoSed, and what should I about it?
At the moment my server is lagging pretty bad, and it crashes.
It's a dedicated server which has run completely fine last two days.
What does this command do?
netstat -n|grep :80|cut -c 45-|cut -f 1 ...
2
votes
5answers
917 views
Block all communication from a list of IP addresses
Is there any firewall(preferred some free :) ) that can block all communication from all ip addresses except from some IP's coming from a particular location...
i basically want to block DDOS attack ...
