A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
-6
votes
1answer
156 views
What are some acceptable easy solutions against DDOS? [closed]
IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd).
Would changing ...
4
votes
2answers
462 views
Is it possible to find the actual source IP of a packet with a spoofed IP header?
I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
0
votes
2answers
988 views
Protecting against DDoS attacks? [duplicate]
Possible Duplicate:
DDoS attack, how to stop?
I'm running a private http server to power a private website. The IP of the server has gone public, thats fine. Nothing to hide anyway.
The ...
0
votes
2answers
218 views
Prevent scanning of the Apache's /default directory
I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server.
I have checked Apache log and somebody is ...
-1
votes
2answers
477 views
DDOS Attacks Explanation [closed]
I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me .
Questions :
what are the ...
1
vote
1answer
76 views
How to get the average packet rate per ip for a port?
Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how?
I'd like to limit new ips to the average inbound ...
1
vote
2answers
858 views
Varnish and Connection Flood (DoS - DDoS)
I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
2
votes
0answers
114 views
Buffer-stuffing denial-of-service attack
I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
6
votes
6answers
2k views
lots of dns requests from China, should I worry?
I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address:
Apr 7 12:36:13 server17 named[26294]: client ...
1
vote
1answer
233 views
DDoS false IP attack [duplicate]
Possible Duplicate:
DDoS attack, how to stop?
I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
0answers
109 views
Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?
iptables -N NEW_TCP_PACKETS_NO_SYN
iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:"
iptables ...
0
votes
1answer
141 views
Dos/ Flood Lag even though Port not Saturated
My GameServers had been under some UDP Floods due to which they generated outputs to the attacker which gave the GameServers some huge lags. Thanks to friends at ServerFault that upon different kind ...
0
votes
2answers
1k views
How to block tcp-reset with iptables to combat DDoS attacks?
I have someone flooding me with random packets on random ports that are closed.
My server is responding to this with tcp-reset packets I think which is chewing up the outbound bandwidth too.
How do ...
0
votes
1answer
345 views
What is the best way to help stop DOS attacks
I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting ...
2
votes
2answers
400 views
Hardening Apache authentication to block brute force attacks (e.g. delay)
Is there a way to configure Apache to slow down login after failed attempts?
It looks like it is not the default setting as already discussed here.
On the other side it seems to be possible also ...
1
vote
1answer
189 views
How to find malicious IPs?
Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
301 views
Logging UDP flood DDOS attacks?
How do I log UDP flood DDOS attacks?
Right now I am thinking about detecting if the server is receiving more than X megabytes per second for Y seconds, and then doing trafshow > logs.txt as root ...
0
votes
4answers
502 views
The more secure iptables script imaginable. Does one exist? [closed]
I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
558 views
DDoS - How to detect an attacker IP address
Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
0
votes
1answer
293 views
Iptables recent module
iptables -A INPUT -p udp -m state --state NEW -m recent --set --name
alimit --rsource
iptables -A INPUT -p udp -m state --state NEW -m ...
3
votes
2answers
444 views
Ubuntu scalable nginx mongodb mongdb memcached server configuration
I have been building a PHP web application using the following techniques in the past 2 months:
PHP 5.3.4
MongoDB
MySql
I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
4answers
439 views
Identifying DOS attack
I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
340 views
Protection against DOS kits (Gootkit)
I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk ...
-3
votes
1answer
176 views
server is being used for ddos attacks, any scripts to search for these? [closed]
One of our vps' on rackspace is being used for ddos'ing which means we have a vulnerability somewhere. Is there any ssh scripts or tools that can scan for scripts doing this?
0
votes
1answer
294 views
Why is nginx taking so long to reply?
I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
1
vote
1answer
333 views
Amazon EC2 abuse
I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host.
Amazon mail content attached for your reference.
...
1
vote
1answer
184 views
Blocking connection based on HTTP header
I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks ...
0
votes
1answer
502 views
DDOS Mitigation for UDP Flood
We are currently under attack on one of our servers at a datacenter in Chicago.
1 gbps (peak) 600mbps average
UDP flood port 80 (incoming)
Consumed 20 TB bandwidth in 2.5 days
We have 50TB of ...
0
votes
2answers
214 views
Locating Source of Inbound DDOS
Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS.
Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec).
In the ...
0
votes
1answer
418 views
(D)DOS Deflate Bug/Alternative
Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
0
votes
1answer
644 views
Configuring Wireshark for Rolling Captures during DDoS Attack
We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
2k views
How to find the connection time-out value in linux?
I am setting up a nginx webserver with php-fpm and (d)dos deflate to ban attacks.
Now currently there is no traffic to my server at all, as i'm testing things.
With this command i can see who is ...
1
vote
3answers
466 views
DDOS Deflate Safe Connection Limit?
I work for a site that often get's attacked by bot networks. We have started to use this tool: http://deflate.medialayer.com/ which auto-bans ip's that have more open connections than the set value. ...
0
votes
1answer
169 views
Very often database PostgreSQL for my webapp fails
I have web application like
Nginx (proxy) + Tomcat (backend) + PostgreSQL (database).
This web application is located on amazon free tier instance (http://aws.amazon.com/free/) and very often from ...
1
vote
2answers
278 views
DoS attack simulation vs real deal
There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be.
What are the key differences between real vs ...
4
votes
2answers
3k views
Stop DoS attacks with an IP tables rule?
I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule?
By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
4answers
221 views
How to set up notifications about server overload? [duplicate]
Possible Duplicate:
What tool do you use to monitor your servers?
How to get notified (preferably by email) when my webserver reaches certain amount of incoming requests? This way I'll be ...
2
votes
2answers
110 views
Resolving a prolonged DDoS
I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
4answers
269 views
Apache getting DDoS
My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
14
votes
3answers
9k views
How can I prevent a DDOS attack on Amazon EC2?
One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
2
votes
1answer
754 views
Packet flooding, is there any way to handle it?
My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
4
votes
2answers
536 views
Web site kills hard disk I/O, how to prevent?
The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
1
vote
2answers
352 views
Software vs. Hardware Appliance DDOS & Firewalls
I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables.
I'm evaluating my security options and was wondering how well ...
0
votes
2answers
744 views
VPS under DDoS Attacks [duplicate]
Possible Duplicate:
Am I getting DDoSed, and what should I about it?
I'm using a 2 VPS Servers.
My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
5
votes
2answers
141 views
DDoS attack case study - Korean election watchdog's site [closed]
Is it possible to break only some of a web site services using DDoS?
For example, disabling only the search feature of a specific website.
I raise this question following a controversy in South ...
0
votes
0answers
113 views
Change nginx settings automatically, when server load increases
I have a server running Debian, and periodically it gets weak DDoS attacks.
Usually it's enough to stricken nginx config like setting up limit_req, but it gives normal users trouble viewing image ...
0
votes
1answer
206 views
Cloudflare performance, ddos
I have been using cloudflare CDN on my website (wordpress) for about 4 months, mostly because I was hoping the CDN would make things faster, and make the load on my cheap server somewhat smaller, ...
2
votes
2answers
559 views
DoS attack requesting single file on server, best way to overcome?
My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!).
Sample from the access log:
186.92.86.149 - - ...
0
votes
1answer
127 views
Blocking all RIPE Addresses in Server 2008?
Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, ...
0
votes
1answer
173 views
Diagnosing DDOS after the fact
I manage the code and deployments for an ASP.net site on a dedicated server. Windows 2008-64 R2, 8GB RAM, Dual Core. It is a dedicated intranet site that never has much traffic. Most of the ...
