A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
1answer
49 views

Is there a service I can redirect/report DDoS clients to?

Currently experiencing a very mild DDoS attack. Just a brute force login attack. This caused a spike in PHP/MySQL usage so I've just blocked logins except from my IP address. I'm not too worried about ...
0
votes
1answer
426 views

How to interpret this jnettop output?

Looks like I'm currently under a DOS attack or something like that, I've been monitoring the traffic on the server using jnettop, this is a of what I see during normal conditions: ...
1
vote
3answers
708 views

High CPU usage in random IP/Port UDP DDoS

I have been getting these UDP floods with random IPs and ports. randomip:randomport -> myip:randomport 0 byte payload For some reason it is using a lot of CPU. Here is the results of perf top -e ...
0
votes
1answer
245 views

Automation of blocking IP address

I have an Ubuntu 12.04 machine running Apache2 which hosts about 10 wordpress websites. Recently I have been subjected to attacks from clients which seem to be sending POST requests to a wordpress ...
5
votes
3answers
331 views

Correct way to handle security threats to web server on budget [closed]

During our annual security review I was reminded of an incident earlier this year where we received a threat to our organizations web server. It was over a organization policy and threatened to DDoS ...
-1
votes
3answers
354 views

How to fight request spam (DDOS i guess) on CentOS server [duplicate]

lately i'm trying to fight DDOS on my CentOS 6.4 server. I have installed CSF and I've set it quite strictly. Yet there is a URL that have like 1000 requests and max 2 per IP (smart ddos-er I guess). ...
0
votes
0answers
480 views

Blocking a TCP Syn Attack

I have recently experienced a TCP Syn attack and since it was from a software like LOIC, it kept happening until I banned the IP Addresses or stopped my system from making output to them. Here is what ...
0
votes
2answers
279 views

Denial of Service coming from Facebook IP addresses

We have a website which appeared to suffer from a denial of service attack. There were several IP addresses involved and these were all registered to Facebook. Here's an excerpt from the Apache log ...
-1
votes
1answer
53 views

GRE tunnel / Route traffic based on which domain the user is trying to access

Imagine this kind of setup. 5 servers. 1 server will be the "front-end", all the traffic has to go through it first before going to the 4 other servers. I don't want people to know the IPs of the ...
0
votes
3answers
316 views

How to handle a DDoS attack on a search engine? [duplicate]

We are running a search engine and are seeing a huge amount of fake search queries coming in over the last days from thousands of IP addresses. There is no real pattern in terms of queries text or IP ...
1
vote
1answer
414 views

Ddos attack getting through iptables [duplicate]

I have been using my own self-made "iptables rules" for blocking all the major type of DDOS attacks on game-servers because these attacks were application/game-server specific instead of the general ...
93
votes
1answer
7k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
0
votes
1answer
253 views

How to stop DDOS from unique ip addresses? [duplicate]

I have a problem with a LAMP server where Apache keeps getting lots of request "POST / HTTP/1.1" but always from new IP addresses. Blocking the IPs using iptables obviously won't help. Any ideas how ...
1
vote
1answer
47 views

Under attack what source url source would this be? [duplicate]

We are under attack since about 2 weeks now and did as much as we can to protect oursefs. mod_reqtimeout is doing the job now but I am confused as what is it that they are hiting I found this post ...
4
votes
2answers
426 views

How to prevent DDoS attacks? [duplicate]

I am a creator of a flash game server. I use cloudflare for my site, however the game tcp server cant be protected by CloudFlare. For about 2 months some person DDoSes my game using direct ip. Every ...
0
votes
1answer
71 views

DDOS on Mail server? [duplicate]

My server has been down most of the day, running top shows several Apache processes (httpd) each one using 70% or more of the CPU, and MySql eating almost all memory. I have tried rebooting the ...
2
votes
1answer
205 views

How to prevent Skype DDOS [duplicate]

Is there a way to monitor number of attempted Skype connections on a specified port and dynamically firewall off the offending IPs if they break a certain threshhold within a specific time limit - in ...
0
votes
2answers
1k views

Blocking UDP packets with a length of 4

My server is being flooded with UDP packets with a length of 4 (header is 32 bytes). 04:56:26.844797 IP 108.241.236.114.47034 > 185.5.173.249.14522: UDP, length 4 04:56:26.844831 IP ...
0
votes
2answers
799 views

HTTP attack - Too many connections & TIME_WAIT

I am running CentOS 6 with http -2.2.15 Going under HTTP attack, i can see many http process running. > netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n > 1 established) > ...
0
votes
2answers
814 views

Defensing againt DDoS attack on Squid server [duplicate]

My Squid (3.1.20 on Ubuntu 13.04) is under DDoS attack (with about 1000 different IPs). I'm using Basic Authentication on it and all of those requests are getting DENIED response but still they ...
0
votes
2answers
780 views

Is My Website Under DDOS Attack? [closed]

Recently I noticed that the CPU load of my server is increasing rapidly. In any day, the CPU load does not reach 2.5. I have the following server: Intel® Xeon® E3-1270 v2 Single Processor - Quad Core ...
2
votes
1answer
162 views

How to protect from DDOS attack that is coming from an exit node

Newroz Telecom (an ISP) is using an exit node (or gateway) for each city they operate in. That is all the users in city A is sharing one public IP (when the users go to a website to show their IP they ...
-3
votes
1answer
202 views

Is this DoS attack [duplicate]

I am seeing a huge number of connections from a single IP. # netstat -alpn | grep :80 | grep 92.98.64.103 tcp 0 0 my.ip.address.x:80 92.98.64.103:45629 TIME_WAIT - ...
3
votes
2answers
252 views

What amount of effort and money should one invest against DDoS threats? [closed]

Typically, when you invest money to protect yourself against some possible threat, you should take into account two factors: the probability (p) of the problem actually happening how much money (m) ...
1
vote
1answer
97 views

What is the best way to compare vhost traffic? [closed]

Recently one of my servers has been subjected to malicious ddos attacks. I have about 12 websites hosted on the server which uses name based v-hosting. I am trying to identify which virtual host(s) ...
2
votes
1answer
214 views

Received Notification of my server be involved in “DNS amplification attack”. How can I stop? [duplicate]

I just received an email from my website internet provider that my server has been "involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks." Here is the full email: ...
1
vote
2answers
2k views

httpd high cpu usage slowing down server response [duplicate]

my client has a image sharing website with about 100.000 visitor per day it has been slowed down considerably since this morning when i checked processes i've notice high cpu usage from http .... ...
0
votes
1answer
85 views

DDoS attacks are killing all my services [duplicate]

I've a few servers running as ssh proxy, someone started to DDOS me, i've installed ddos deflate and apf. The traffic made by ddos downgrade from 10 MB/s to 1 MB/s but it still make my users kick from ...
0
votes
4answers
82 views

How to identify which website on my instance is receiving lots of traffic?

I am new to server administration and have just setup a new quad core instance which hosts around 15 websites. Over the past couple of days my server load has been averaging at around 15.00. I ...
3
votes
1answer
608 views

problems simulating TCP SYN flood

I'm trying to simulate a TCP SYN flood to tune a web server (planning to deploy on AWS). I setup a 'target' VM, disabled iptables and running hping (hping -p 80 -i u1000 -c 1000 -S destaddr) from ...
0
votes
1answer
1k views

IPTables : prevent UDP Flooding

I want to stop the UDP flooding on the Linux device. I have written a simple IPTable rule to drop all UDP packets iptables -A INPUT -p udp DROP But still the DoS attack happens and the device gets ...
5
votes
6answers
9k views

Tools for simulating DDoS attacks

I wanted to test my website if it can sustain strong DDoS's, but I don't know which tools could I use to simulate them in my website. What tools are used to simulate DDoS? I found bonesi but it was ...
2
votes
1answer
595 views

Outlook for Mac, Active Directory DNS and DDOS

Edit: This is not a question about DDOS, but a question about how to resolve a technical issue impacting only Mac clients of Outlook Anywhere. Problem and solution are are now known, but I cannot ...
1
vote
1answer
134 views

can I filter TCP SYN packets with seq=0

My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs. Packets look like this: IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0 with ...
1
vote
1answer
720 views

Mitigate DDoS attack by Null-routing my server's IP?

My services were attacked by what appears to be a botnet of quite a large number of computers. Since all my servers have additional IPs, and my hosting provider lets me null-route my IP addresses to ...
0
votes
1answer
1k views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-1
votes
1answer
224 views

Can the netstat command show what specific website a user is on? [closed]

I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I ...
0
votes
3answers
424 views

Can you block an ip with multiple connections? (Apache ddos attack)

My server is under a Apache ddos attack right now. There's a ton of single ip addresses with 30+ connections. When I use this SSH command: netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk ...
-1
votes
2answers
298 views

Router DDoS Protection by MAC [duplicate]

I was wondering if there are any DDoS defences where a (any) router will block all packets (for any period of time) from the MAC address of its attacker. If so, under what circumstances would this ...
2
votes
0answers
78 views

How to prevent HTTP-based DDoS attacks [duplicate]

This night, I've noticed nginx was not responding to requests. After some investigation, I found that it was using 100% of the CPU and error.log was full of messages like this one: 2013/05/28 ...
0
votes
1answer
67 views

Send mails from secondary server

Problem: When I send an email from my server, the email headers contain the IP address of the server. Yeah, this is a problem, because the server is being the target of DDoS attacks. Using CloudFlare ...
0
votes
1answer
726 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
0answers
419 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
1answer
937 views

Nginx - Redirect request by GET parameters pattern

One of my servers was attacked by DDoS a couple of days ago and it lasted for 4 days. Below are the logs snippet of the request: 36.224.180.253 - - [14/May/2013:03:11:46 +0800] "GET ...
3
votes
1answer
138 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive ...
0
votes
1answer
5k views

How to configure mod_reqtimeout in Apache2

I need to configure mod_reqtimeout in my Apache server v2.2.22 (in a linux machine). Problem is, I have absolutely no clue on how to do it. I checked the Apache site on this module at this link but ...
0
votes
1answer
295 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
4
votes
1answer
233 views

Windows server 2008, a very small DDoS is able to kill my server [duplicate]

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
0
votes
1answer
839 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
272 views

Parse Apache logfile and ban IPs

My server is under attack, it is flooded with request with the following pattern: Thousands of IPs Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...