A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

3
votes
1answer
103 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive ...
3
votes
1answer
260 views

iptables, what to open on INPUT for wget

I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
3
votes
1answer
399 views

iptables - drop all HTTP(S) traffic but from CloudFlare

I would like to allow only HTTP(S) traffic coming from CloudFlare. In that way attackers cannot attack the server directly. I know CloudFlare is not mainly a DDoS mitigator, but I would like to try ...
3
votes
1answer
58 views

Perform action based on load avg

I'm running some web applications on an debian server and have to struggle with ddos attacks sometimes. It's eating up all my resources and I can't ssh anymore into the server. An idea was to drop all ...
3
votes
4answers
3k views

EC2 ELB and DOS attacks

I'm using Amazon's ELB to load balance between servers, When my site is under attack by bots, everything is exhausted, so here is the problem I can't block IP addresses with Amazon's security ...
3
votes
1answer
483 views

Stopping SYN DDoS Attack [duplicate]

One of my servers is under constant SYN DDoS attack. I have decided to setup fail2ban but as far as I can understand, that will only take care of the ssh login attacks. How can I stop these SYN DDoS ...
3
votes
3answers
3k views

Protecting Hosted Windows 2008 Servers against DDOS Attacks

Followup to Identifying DDOS Attacks on Windows 2008 Servers. What steps are people taking to prevent DDOS attacks against their Windows 2008 Servers in a hosted environment? I'm particularly ...
3
votes
1answer
307 views

problems simulating TCP SYN flood

I'm trying to simulate a TCP SYN flood to tune a web server (planning to deploy on AWS). I setup a 'target' VM, disabled iptables and running hping (hping -p 80 -i u1000 -c 1000 -S destaddr) from ...
3
votes
2answers
490 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
3
votes
2answers
2k views

How to block null/blank user-agents in IIS 7.5

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it. Here ...
3
votes
1answer
159 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
2
votes
3answers
813 views

Am I getting DDoSed, and what should I about it?

At the moment my server is lagging pretty bad, and it crashes. It's a dedicated server which has run completely fine last two days. What does this command do? netstat -n|grep :80|cut -c 45-|cut -f 1 ...
2
votes
4answers
4k views

How can I stop a currently active DDoS attack? [duplicate]

My VPS is under a DDoS attack. I cannot access RDP, and I cannot take it offline, or access it in any way at all. What can I do? They are not trying to bruteforce, just trying to stop access to the ...
2
votes
5answers
1k views

Block all communication from a list of IP addresses

Is there any firewall(preferred some free :) ) that can block all communication from all ip addresses except from some IP's coming from a particular location... i basically want to block DDOS attack ...
2
votes
2answers
734 views

DDoS Attacks on Game Servers [duplicate]

We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
2
votes
3answers
821 views

Does a VPS mitigate risks of a DDOS attack versus shared hosting?

A client of mine has a website on a shared hosting account, and one of the other accounts on that server was targeted by a DDOS attack, which of course brought all of the websites on that server down. ...
2
votes
4answers
334 views

Apache getting DDoS [duplicate]

My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
2
votes
1answer
141 views

Received Notification of my server be involved in “DNS amplification attack”. How can I stop? [duplicate]

I just received an email from my website internet provider that my server has been "involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks." Here is the full email: ...
2
votes
2answers
217 views

What happens if a server never receives the RST packet?

Someone recently decided to show me a POC of a new Denial of Service method using SYN/TCP he's figured out. I thought it was complete nonsense, but after explaining to him about SYN-SYN/ACK-RST, he ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
2
votes
2answers
78 views

Will MX records with a longer TTL help mitigate effects of DoS attack?

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
2
votes
4answers
541 views

mod_rewrite and access.log

My site recently came under a DOS attack, which seems to have been mostly fixed by installing mod-evasive (which is fine) I wanted to find the IP which was used for the attack so naturally I went to ...
2
votes
4answers
2k views

Mitigating an http flood? [duplicate]

I have a ddos protection proxy in place to deal with SYN floods and such. But http floods are still getting through. For some reason their ddos proxy is not blocking any of the flood. So there are ...
2
votes
3answers
522 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
2
votes
2answers
758 views

Dedicated servers with DDOS protection [closed]

My client are a small business and they recently got flooded by DDOS attack. The website is a ecommerce app and the company sells audio equipment. Who would have thought? But turned out the ...
2
votes
1answer
373 views

SOLVED : Outlook for Mac, Active Directory DNS and DDOS

Edit: This is not merely a question about DDOS, but a question about how to resolve a technical issue impacting only Mac clients of Outlook Anywhere. Problem and solution are are now known, see ...
2
votes
2answers
1k views

Tune Linux kernel against SYN flood attack

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile ...
2
votes
2answers
537 views

Hardening Apache authentication to block brute force attacks (e.g. delay)

Is there a way to configure Apache to slow down login after failed attempts? It looks like it is not the default setting as already discussed here. On the other side it seems to be possible also ...
2
votes
3answers
337 views

How do you deal with malicious IP's?

I'm trying to figure out how to protect my server against what it seems to be a botnet (I'm just guessing) Everyday, more and more IP's fill my application logs with invalid request (eg: GET requests ...
2
votes
4answers
196 views

Blocking attacker's IPs: What options do I have?

A website of mine is being attacked by some IPs. I don't even know if it was a ddos yet, I only know that it has been filling my application's logs for longer than a day, and then the server crashed ...
2
votes
3answers
4k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
2
votes
1answer
210 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
2
votes
2answers
113 views

How can I mitigate DNS Server outages?

Let's say I have a root domain of "mysite.com". That domain and its sub-domains have DNS served by an external service - let's call them Setwork Nolutions. If this external company is hit with a DDoS ...
2
votes
2answers
116 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
3answers
570 views

ddos protection for dedicated server [duplicate]

Whats the best way to protect a linux root server from a ddos attack? I just want to inform myself about the issue. I'm wondering I haven't found a good solution. anybody has one? thanks!
2
votes
3answers
1k views

Blocking IP addresses Load Balanced Cluster

We're using HAproxy as a front end load balancer / proxy and are looking for solutions to block random IP addresses from jamming the cluster. Is anyone familiar with a conf for HAProxy that can block ...
2
votes
1answer
3k views

/usr/bin/host being used in HTTP DDoS on Debian? [duplicate]

So I got an abuse complaint for one of my dedicated servers, running Debian 6.0 Sure enough, sometimes, top shows /usr/bin/host using a lot of CPU for no apparent reason, and netstat shows process ...
2
votes
1answer
144 views

How to prevent Skype DDOS [duplicate]

Is there a way to monitor number of attempted Skype connections on a specified port and dynamically firewall off the offending IPs if they break a certain threshhold within a specific time limit - in ...
2
votes
2answers
660 views

DoS attack requesting single file on server, best way to overcome?

My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!). Sample from the access log: 186.92.86.149 - - ...
2
votes
1answer
4k views

SynFlood Attacks : How many packets per Second are possible per Mbit?

i would be greatfull for the exact calculation/formula how to calculate how much SYN packets can be send per 1 Mbit Bandwith: 1.) What is the Size (in Bytes) of one SYN-Packet = 20 Bytes? ...
2
votes
1answer
593 views

Fighting DDoS Attack, looking for some advice [duplicate]

So, it appears about 2 IP addresses are overloading my HTTP server (apache) over UDP and I am unable to stop this using IP Tables. I am using CentOS 5. I managed to block some other IP addresses that ...
2
votes
3answers
606 views

Force Apache2.2 to drop a request

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a ...
2
votes
4answers
3k views

How to protect Lighttpd from DOS attacks and flooding? [duplicate]

I have a problem with Lighttpd because someone started to use some Web downloader from very good connection and it blocked my whole website. Is there any way to protect Lighttpd from DDOS attacks and ...
2
votes
1answer
89 views

How to protect from DDOS attack that is coming from an exit node

Newroz Telecom (an ISP) is using an exit node (or gateway) for each city they operate in. That is all the users in city A is sharing one public IP (when the users go to a website to show their IP they ...
2
votes
1answer
848 views

How do I drop “empty” HTTP packets using iptables? [duplicate]

I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
2
votes
1answer
232 views

Mitigate DDoS Proxy attack [duplicate]

In last days my apache is being attacked by many connections from proxies. I've identified the source but could not block the attack effectively. The attacker seems to be using pyloris or a variation ...
2
votes
3answers
745 views

Nginx and php-fpm fails with high load: “Possible SYN flooding on port 80” and “104: Connection reset by peer”

I have quite heavy loaded web server using: Ubuntu server nginx php-fpm + apc Yesterday something wierd happened with my server. It crashed and stopped responding and after I rebooted it, web pages ...
2
votes
2answers
99 views

how to track which switches, routers are being affected by ddos

I have an enterprise network system which has a router facing the internet, beneath it a virtual chassis switch, below it an access layer switch and finally a server. My question is that when there is ...
2
votes
1answer
1k views

Windows Server 2008: Limit UDP/TCP packets per IP or ban

How I can limit UDP/TCP packets per IP send to my host (or better PORT) per second or minute ? Would be nice to ban that IP for 12/24 hours or even for ever. I got Windows Server 2008 and I'm very ...
2
votes
1answer
453 views

Mitigate HTTP connect floods with HAproxy + Apache

Our infrastructure consists of load balancers running HAProxy and Apache, which forward traffic to our app servers running just Apache. The past few days, we've been seeing connection floods which the ...