A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
1answer
887 views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-1
votes
1answer
181 views

Can the netstat command show what specific website a user is on? [closed]

I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I ...
0
votes
3answers
370 views

Can you block an ip with multiple connections? (Apache ddos attack)

My server is under a Apache ddos attack right now. There's a ton of single ip addresses with 30+ connections. When I use this SSH command: netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk ...
-1
votes
2answers
229 views

Router DDoS Protection by MAC [duplicate]

I was wondering if there are any DDoS defences where a (any) router will block all packets (for any period of time) from the MAC address of its attacker. If so, under what circumstances would this ...
2
votes
0answers
76 views

How to prevent HTTP-based DDoS attacks [duplicate]

This night, I've noticed nginx was not responding to requests. After some investigation, I found that it was using 100% of the CPU and error.log was full of messages like this one: 2013/05/28 ...
0
votes
1answer
56 views

Send mails from secondary server

Problem: When I send an email from my server, the email headers contain the IP address of the server. Yeah, this is a problem, because the server is being the target of DDoS attacks. Using CloudFlare ...
0
votes
1answer
545 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
0answers
357 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
1answer
731 views

Nginx - Redirect request by GET parameters pattern

One of my servers was attacked by DDoS a couple of days ago and it lasted for 4 days. Below are the logs snippet of the request: 36.224.180.253 - - [14/May/2013:03:11:46 +0800] "GET ...
3
votes
1answer
123 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive ...
0
votes
1answer
3k views

How to configure mod_reqtimeout in Apache2

I need to configure mod_reqtimeout in my Apache server v2.2.22 (in a linux machine). Problem is, I have absolutely no clue on how to do it. I checked the Apache site on this module at this link but ...
0
votes
1answer
259 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
4
votes
1answer
205 views

Windows server 2008, a very small DDoS is able to kill my server

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
0
votes
1answer
707 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
231 views

Parse Apache logfile and ban IPs

My server is under attack, it is flooded with request with the following pattern: Thousands of IPs Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
-1
votes
1answer
473 views

Any way to Improve performance of iptables DDOS whitelist? [closed]

I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
2answers
551 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
1answer
966 views

ICMP time exceeded in-transit

In the last few days my server suffers an attack of this kind: (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs) tcpdump -n proto ICMP 17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
1answer
235 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
0
votes
2answers
79 views

Will I get banned or blocked for running a diagnostic app?

This may seem like a simple question. Hopefully it will have a simple answer. I run an internet radio station. There are 3 machines. Music source client Stage server Master server (relays the ...
0
votes
1answer
98 views

Lot of Apache requests in “L” state, what could be the reason? DDOS?

I am having this in my apache server status message: LLLLLLLLLLLLLLLWLLLLLLLLWLLLLLWLLLLLLLLLLWLLLLLLLWLLLLLLLLLLLLLL WLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLWLWLLLLLLLLL ...
0
votes
3answers
799 views

iptables rule to stop DDOS [duplicate]

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
0
votes
3answers
399 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
0answers
234 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...
3
votes
1answer
350 views

iptables, what to open on INPUT for wget

I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
0
votes
1answer
105 views

ssyn.c and slow.c used on my VPS [duplicate]

I have noticed some changes on VPS Debian Squeeze and looked with history to see what commands were run. Then I found some which I'm 100% sure I didn't run because I don't know what are they. Somebody ...
0
votes
1answer
130 views

Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]

I have a non-Xen VPS (don't exactly know what the software is). The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
1answer
250 views

Cisco ACL Block by Packet Length

I am presently blocking a small scale DDOS attack using IP addresses but all the packets are the same size, 1514 bits and I kind of don't want to fill up an ACL rule with a bunch of IPs. After reading ...
0
votes
2answers
1k views

Detect process that is doing an outbound DDoS attack [duplicate]

My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the ...
2
votes
1answer
1k views

How do I drop “empty” HTTP packets using iptables? [duplicate]

I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
0
votes
2answers
782 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
14
votes
4answers
1k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
2answers
269 views

netfilter ip_conntrack and (d)DoS

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
2
votes
1answer
387 views

Spoofed DDoS protection strategy, filter window size == 0?

I was hit by a SYN flood that nearly killed the network stack of my ipvs loadbalancer (80K packets/sec). The "ksoftirqd" process took 100% CPU, the machine was nearly unresponsive from the network. A ...
0
votes
2answers
329 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
-2
votes
2answers
366 views

Determine packets per second [closed]

What is an ideal way to get the number of packets per second on a Linux box? Would I use tcpdump or are there better methods?
2
votes
1answer
261 views

Mitigate DDoS Proxy attack [duplicate]

In last days my apache is being attacked by many connections from proxies. I've identified the source but could not block the attack effectively. The attacker seems to be using pyloris or a variation ...
0
votes
1answer
252 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
0
votes
2answers
601 views

what does “eth0: link up” mean? /var/log/messages

My server is being attacked (SYN flood attack) and what I see in /var/log/messages is a ton of: r8169: eth0: link up r8169: eth0: link up r8169: eth0: link up 1. What does this mean? I can't ...
-1
votes
1answer
737 views

CentOS server RAM usage 100%

I am using Linux CentOS 5.8 VPS. But my site is so slow in last two days. When i cehcked in server's web control panel; RAM usage is 99-100 %. But when i write "top" command; there is any usage on ...
2
votes
3answers
901 views

Nginx and php-fpm fails with high load: “Possible SYN flooding on port 80” and “104: Connection reset by peer”

I have quite heavy loaded web server using: Ubuntu server nginx php-fpm + apc Yesterday something wierd happened with my server. It crashed and stopped responding and after I rebooted it, web pages ...
1
vote
3answers
165 views

DDOS protection from ISP side, UDP protocol, whitelist

Is it possible to ignore packets from ISP side which are incoming to my server? Is possible this kind of situation ? : I have white list of IP addresses. I continually update white list and sends it ...
2
votes
2answers
2k views

Tune Linux kernel against SYN flood attack

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile ...
10
votes
1answer
1k views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
-1
votes
1answer
645 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
8
votes
3answers
996 views

RedStation.com is heaven for ddos attackers, How to file complaint? [closed]

Sorry, I don't know where to open this subject. This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
1
vote
2answers
453 views

How can I prevent an unintentional DDOS running ColdFusion 8 with IIS 6?

We had an interesting outage today on one of our client's websites. Out of nowhere, the website was inaccessible. The website runs by itself on a dedicated physical Windows 2003 R2 server (probably ...
-2
votes
2answers
146 views

hardware antiddos solution [closed]

We have three servers on colo in datacenter for hi-load e-commerce web project connected via cisco catalyst 2960. We need to make antiddos system with hardware firewall, CISCO Guard etc. CISCO Guard ...
0
votes
1answer
42 views

My site is inaccessible from different locations on-and-off. What's happening?

On-and-off for the last few days, my sites (www.)aderet.org and to a lesser extent (www.)saveadullam.org have been down from (two different networks in) Israel. Over a period of minutes or seconds, ...
0
votes
1answer
154 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...