A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

3
votes
1answer
107 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive ...
0
votes
1answer
2k views

How to configure mod_reqtimeout in Apache2

I need to configure mod_reqtimeout in my Apache server v2.2.22 (in a linux machine). Problem is, I have absolutely no clue on how to do it. I checked the Apache site on this module at this link but ...
0
votes
1answer
215 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
4
votes
1answer
188 views

Windows server 2008, a very small DDoS is able to kill my server

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
0
votes
1answer
526 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
179 views

Parse Apache logfile and ban IPs

My server is under attack, it is flooded with request with the following pattern: Thousands of IPs Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
-1
votes
1answer
403 views

Any way to Improve performance of iptables DDOS whitelist? [closed]

I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
2answers
445 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
1answer
586 views

ICMP time exceeded in-transit

In the last few days my server suffers an attack of this kind: (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs) tcpdump -n proto ICMP 17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
1answer
186 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
0
votes
2answers
75 views

Will I get banned or blocked for running a diagnostic app?

This may seem like a simple question. Hopefully it will have a simple answer. I run an internet radio station. There are 3 machines. Music source client Stage server Master server (relays the ...
0
votes
1answer
71 views

Lot of Apache requests in “L” state, what could be the reason? DDOS?

I am having this in my apache server status message: LLLLLLLLLLLLLLLWLLLLLLLLWLLLLLWLLLLLLLLLLWLLLLLLLWLLLLLLLLLLLLLL WLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLWLWLLLLLLLLL ...
0
votes
3answers
720 views

iptables rule to stop DDOS [duplicate]

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
0
votes
3answers
357 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
0answers
200 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...
3
votes
1answer
278 views

iptables, what to open on INPUT for wget

I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
0
votes
1answer
85 views

ssyn.c and slow.c used on my VPS [duplicate]

I have noticed some changes on VPS Debian Squeeze and looked with history to see what commands were run. Then I found some which I'm 100% sure I didn't run because I don't know what are they. Somebody ...
0
votes
1answer
122 views

Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]

I have a non-Xen VPS (don't exactly know what the software is). The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
1answer
214 views

Cisco ACL Block by Packet Length

I am presently blocking a small scale DDOS attack using IP addresses but all the packets are the same size, 1514 bits and I kind of don't want to fill up an ACL rule with a bunch of IPs. After reading ...
0
votes
2answers
951 views

Detect process that is doing an outbound DDoS attack [duplicate]

My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the ...
2
votes
1answer
903 views

How do I drop “empty” HTTP packets using iptables? [duplicate]

I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
0
votes
2answers
686 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
14
votes
4answers
1k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
2answers
238 views

netfilter ip_conntrack and (d)DoS

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
2
votes
1answer
336 views

Spoofed DDoS protection strategy, filter window size == 0?

I was hit by a SYN flood that nearly killed the network stack of my ipvs loadbalancer (80K packets/sec). The "ksoftirqd" process took 100% CPU, the machine was nearly unresponsive from the network. A ...
0
votes
2answers
294 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
-2
votes
2answers
322 views

Determine packets per second [closed]

What is an ideal way to get the number of packets per second on a Linux box? Would I use tcpdump or are there better methods?
2
votes
1answer
236 views

Mitigate DDoS Proxy attack [duplicate]

In last days my apache is being attacked by many connections from proxies. I've identified the source but could not block the attack effectively. The attacker seems to be using pyloris or a variation ...
0
votes
1answer
235 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
0
votes
2answers
536 views

what does “eth0: link up” mean? /var/log/messages

My server is being attacked (SYN flood attack) and what I see in /var/log/messages is a ton of: r8169: eth0: link up r8169: eth0: link up r8169: eth0: link up 1. What does this mean? I can't ...
-1
votes
1answer
648 views

CentOS server RAM usage 100%

I am using Linux CentOS 5.8 VPS. But my site is so slow in last two days. When i cehcked in server's web control panel; RAM usage is 99-100 %. But when i write "top" command; there is any usage on ...
2
votes
3answers
779 views

Nginx and php-fpm fails with high load: “Possible SYN flooding on port 80” and “104: Connection reset by peer”

I have quite heavy loaded web server using: Ubuntu server nginx php-fpm + apc Yesterday something wierd happened with my server. It crashed and stopped responding and after I rebooted it, web pages ...
1
vote
3answers
153 views

DDOS protection from ISP side, UDP protocol, whitelist

Is it possible to ignore packets from ISP side which are incoming to my server? Is possible this kind of situation ? : I have white list of IP addresses. I continually update white list and sends it ...
2
votes
2answers
1k views

Tune Linux kernel against SYN flood attack

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile ...
10
votes
1answer
956 views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
-1
votes
1answer
506 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
8
votes
3answers
887 views

RedStation.com is heaven for ddos attackers, How to file complaint? [closed]

Sorry, I don't know where to open this subject. This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
1
vote
2answers
400 views

How can I prevent an unintentional DDOS running ColdFusion 8 with IIS 6?

We had an interesting outage today on one of our client's websites. Out of nowhere, the website was inaccessible. The website runs by itself on a dedicated physical Windows 2003 R2 server (probably ...
-2
votes
2answers
138 views

hardware antiddos solution [closed]

We have three servers on colo in datacenter for hi-load e-commerce web project connected via cisco catalyst 2960. We need to make antiddos system with hardware firewall, CISCO Guard etc. CISCO Guard ...
0
votes
1answer
40 views

My site is inaccessible from different locations on-and-off. What's happening?

On-and-off for the last few days, my sites (www.)aderet.org and to a lesser extent (www.)saveadullam.org have been down from (two different networks in) Israel. Over a period of minutes or seconds, ...
0
votes
1answer
135 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
1answer
145 views

Server Recovery from Denial of Service

I'm looking at a server that might be misconfigured to handle Denial of Service. The database was knocked offline after the attack, and was unable to restart itself after it failed to restart when the ...
4
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
1
vote
1answer
2k views

pfSense + DDoS Protection [duplicate]

I run a gaming community on a colo with a 100Mbps port. I want to buy a very cheap 35 dollar server with the same 100Mbps port, and run pfSense to use as a hardware firewall. I'm dealing with a bunch ...
1
vote
2answers
114 views

How can I determine the method of this DDoS attack? [duplicate]

My server went down earlier - looks like a DDoS. A spike in traffic to around 13mbit, the swap goes from idle to maxed in about 5 minutes, and server stops responding. I would like to protect ...
3
votes
1answer
437 views

iptables - drop all HTTP(S) traffic but from CloudFlare

I would like to allow only HTTP(S) traffic coming from CloudFlare. In that way attackers cannot attack the server directly. I know CloudFlare is not mainly a DDoS mitigator, but I would like to try ...
2
votes
1answer
357 views

Using Varnish (only) for DDoS mitigation [duplicate]

My VPS is suffering from a (D)DoS doing a SYN flood with spoofed IPs. I'm right now searching from ways how to be able to defend (at least a bit) against it. It's running a DirectAdmin apache2 ...
0
votes
0answers
112 views

Imagemagick/File upload abuse causing my memory errors

I had been running out of memory on my server lately and I noticed some individuals uploading the same "file" over and over in quick succession which locks up my instance of mini_magick. Eventually ...
2
votes
2answers
102 views

how to track which switches, routers are being affected by ddos

I have an enterprise network system which has a router facing the internet, beneath it a virtual chassis switch, below it an access layer switch and finally a server. My question is that when there is ...
0
votes
4answers
2k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...