A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

8
votes
7answers
7k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
1
vote
1answer
323 views

Can you stop a SYN Flood attack with .htaccess?

[Linux - CentOS - Apache - VPS] Last week my servers came under a SYN Flood attack, my hosting provider took some steps and resolved the issue. One of the things that they did was turn on SYN ...
2
votes
1answer
1k views

Windows Server 2008: Limit UDP/TCP packets per IP or ban

How I can limit UDP/TCP packets per IP send to my host (or better PORT) per second or minute ? Would be nice to ban that IP for 12/24 hours or even for ever. I got Windows Server 2008 and I'm very ...
5
votes
3answers
1k views

How can I block a specific type of DDoS attack?

My site is being attacked and is using up all the RAM. I looked at the Apache logs and every malicious hit seems to simply be a POST request on /, which is never required by a normal user. So I ...
1
vote
0answers
51 views

Effective ways of mitigating Spoofed Syn Flood with iptables [duplicate]

Possible Duplicate: SYN Flood Advice Heyo, Been dealing alot with spoofed syn floods lately. Are there any tips or tricks we could do to better survive them? Syn Cookies are already ...
2
votes
1answer
469 views

Mitigate HTTP connect floods with HAproxy + Apache

Our infrastructure consists of load balancers running HAProxy and Apache, which forward traffic to our app servers running just Apache. The past few days, we've been seeing connection floods which the ...
1
vote
1answer
638 views

Protecting Apache and Nginx against slow read/write and similar attacks?

There are many articles explaining many ways to attack webservers (generic or specific) and even listing general rules for mitigating such attacks, e.g.: Do not accept connections with abnormally ...
0
votes
0answers
115 views

Delay response from apache when loaded with requests

So currently a bot hammers our server and causes high server load / dropped responses. I don't want to stop the bot as it has a purpose but I would like to slow it down. I've implemented squid to ...
12
votes
3answers
673 views

DNS down in Anonymous attack

As I'm writing this our company website and the web-service we developed are down in the big GoDaddy outage resulting from an Anonymous attack (or so says Twitter). We used GoDaddy as our registrar ...
0
votes
1answer
185 views

DDoS attacks to PBX [closed]

I'm wondering if DDOS attacks to PBX or telecommunications systems is possibe real. According to this links: ...
0
votes
1answer
530 views

*Simple* way to block DDoS by number of requests

I have 3 Varnish 3.0.2 servers with Apache 2 as backends, which are being load balanced through a HAproxy separate server. I need to find a very simple program (I'm not much of a sysadmin), which ...
1
vote
1answer
133 views

ip_conntrack ideal or not for server stability

By default the module ip_conntrack is installed into the kernel. My question is simple, is having ip_conntrack a performance booster for better tracking of connections? On VPS nodes they do not have ...
1
vote
1answer
449 views

Why is FunWebProducts flooding my server?

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible? 89.70.25.120 - - ...
2
votes
2answers
220 views

What happens if a server never receives the RST packet?

Someone recently decided to show me a POC of a new Denial of Service method using SYN/TCP he's figured out. I thought it was complete nonsense, but after explaining to him about SYN-SYN/ACK-RST, he ...
0
votes
1answer
554 views

mod evasive not working properly on ubuntu 10.04

I have an ubuntu 10.04 server where I installed mod_evasive using apt-get install libapache2-mod-evasive I already tried several configurations, the result stays the same. The blocking does work, ...
3
votes
1answer
61 views

Perform action based on load avg

I'm running some web applications on an debian server and have to struggle with ddos attacks sometimes. It's eating up all my resources and I can't ssh anymore into the server. An idea was to drop all ...
-2
votes
1answer
570 views

Possible form for a ddos attack? [duplicate]

I have kinda asked this before. I've set up a server that serves my website, dns and some gameservers. However, when I check my routers firewall log, I get alot of incoming UDP packets blocked on the ...
13
votes
9answers
5k views

Public Facing Recursive DNS Servers - iptables rules

We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks? The ...
0
votes
4answers
989 views

How to tune Linux kernel to withstand DDoS? (HAProxy)

Please do not reply with "this is not possible", as it's waste of time. I am developing cloud appliance and I have a valid reason to protect this layer against DDoS, and there are few companies doing ...
3
votes
2answers
989 views

Can DDoS be stopped with BGP? [duplicate]

When I am experiencing DDoS @10Gbps, if I have BGP router with 10M table entries in it, can I perform search on the offensive network? I would do this the way, that first I would remove routing to me ...
0
votes
4answers
6k views

How to prevent DDOS syn attack [duplicate]

I am running a site with 2 GB ram on centos. Using LAMP Everyday for a few hours (about 3 to 4 hours) apache goes down. It takes too long to load a page and most of time it shows Request time out. ...
-4
votes
1answer
121 views

Blocking hostgator/bluehost/theplanet ips [closed]

I am getting massive scrapers from Hostgator, theplanet, bluehost and dreamhost servers. I am tired of blocking their server ips manually. Is there anyway to get their ip ranges?
3
votes
1answer
6k views

How can I detect a DDoS attack using pfSense so I can tell my ISP who to block? [duplicate]

Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host. I understand (from this ...
1
vote
1answer
364 views

Nginx: block requests to external URLs

I'm running a couple of web hosting servers with Directadmin. I'm running Apache as main web server with Nginx working as a proxy in front of it. In order to keep Nginx "invisible" to Directadmin, I ...
0
votes
1answer
72 views

DNS workaround for webhost DDoS [duplicate]

My webhoster seems to have some troubles with DDOS attacks and routing overload. This makes my IP to be not available sometimes and I'd like to add a failover IP for the domain. However, 2 A-Records ...
1
vote
1answer
369 views

DROP vs REJECT DDoS [duplicate]

I asked somewhere else, and I got this response: Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine ...
0
votes
2answers
687 views

Monitor incoming TCP/UDP flood attack and graph it

I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results. I have some VPSes that will perform ...
-1
votes
3answers
7k views

iptables rules to counter the most common DoS attacks? [closed]

Recently I've got a lot of small scale DoS attacks. I am wondering what iptables rules should I use to counter the most common DoS attacks, and generally secure my web server. The web server sports ...
1
vote
2answers
622 views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
0
votes
1answer
3k views

How to know which site/script is taking all CPU and RAM in Plesk/apache

I have more than 100+ domains on a CentOS Plesk server. Suddenly the load on the server goes very high and eats up all resources. eating up all RAM, all CPU , due to which i cannot even login to ...
1
vote
1answer
259 views

Redundant Router and Load Balancing vs. DDoS attack [duplicate]

With a small server farm at a hoster with great support and conditions, I worry about the increasing number of DDoS attacks against this hoster (not my web project, but other clients on the same ...
0
votes
1answer
3k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
3
votes
4answers
3k views

EC2 ELB and DOS attacks

I'm using Amazon's ELB to load balance between servers, When my site is under attack by bots, everything is exhausted, so here is the problem I can't block IP addresses with Amazon's security ...
0
votes
1answer
887 views

Best Practice for captcha based protection against D.O.S to Nginx Proxy

The idea is explained here In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers. If the number of request times within a certain period from ...
0
votes
1answer
395 views

DDos attack filter [duplicate]

Im running a debian linux VPS server with a garrysmod server. Today I've recieved a ddos attack and I could log by using tshark the next: 4.213248 91.204.63.5 -> 176.58.101.xx UDP Source port: ...
0
votes
3answers
1k views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
-2
votes
2answers
189 views

Nginx massive error.log, am I being DDOSed?

So I just opened up my Nginx error log as all my pages are throwing error code 500. It's enormous, my site is still in development and their are well over 100k errors for resources Nginx was unable ...
-1
votes
1answer
291 views

Linux tools to choose suitable Cisco ASA 5500 [closed]

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
-4
votes
3answers
288 views

How do i mitigate DDOS attacks on static servers?

Here is a slightly different take on DDOS attacks. Rather than a server with dynamic content being attack i was curious how to deal with attacks on servers with STATIC CONTENT. This means cpu tends to ...
-6
votes
1answer
179 views

What are some acceptable easy solutions against DDOS? [closed]

IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd). Would changing ...
4
votes
2answers
498 views

Is it possible to find the actual source IP of a packet with a spoofed IP header?

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
0
votes
2answers
1k views

Protecting against DDoS attacks? [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm running a private http server to power a private website. The IP of the server has gone public, thats fine. Nothing to hide anyway. The ...
0
votes
2answers
447 views

Prevent scanning of the Apache's /default directory

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is ...
-1
votes
2answers
631 views

DDOS Attacks Explanation [closed]

I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me . Questions : what are the ...
1
vote
1answer
81 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
1
vote
2answers
1k views

Varnish and Connection Flood (DoS - DDoS) [duplicate]

I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
3
votes
1answer
165 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
1
vote
1answer
323 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
0answers
127 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...