A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
1answer
299 views

Cisco ACL Block by Packet Length

I am presently blocking a small scale DDOS attack using IP addresses but all the packets are the same size, 1514 bits and I kind of don't want to fill up an ACL rule with a bunch of IPs. After reading ...
1
vote
2answers
337 views

PHP web hosting: how to prevent clients to DOS/DDOS? [duplicate]

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts. Besides the security routine I'll have to check (off topic here) I would like to know ...
0
votes
2answers
2k views

Detect process that is doing an outbound DDoS attack [duplicate]

My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the ...
2
votes
1answer
1k views

How do I drop “empty” HTTP packets using iptables? [duplicate]

I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
0
votes
2answers
823 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
14
votes
4answers
1k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
2answers
311 views

netfilter ip_conntrack and (d)DoS [duplicate]

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
2
votes
1answer
451 views

Spoofed DDoS protection strategy, filter window size == 0?

I was hit by a SYN flood that nearly killed the network stack of my ipvs loadbalancer (80K packets/sec). The "ksoftirqd" process took 100% CPU, the machine was nearly unresponsive from the network. A ...
0
votes
2answers
342 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
-2
votes
2answers
399 views

Determine packets per second [closed]

What is an ideal way to get the number of packets per second on a Linux box? Would I use tcpdump or are there better methods?
2
votes
1answer
285 views

Mitigate DDoS Proxy attack [duplicate]

In last days my apache is being attacked by many connections from proxies. I've identified the source but could not block the attack effectively. The attacker seems to be using pyloris or a variation ...
0
votes
1answer
271 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
0
votes
2answers
708 views

what does “eth0: link up” mean? /var/log/messages

My server is being attacked (SYN flood attack) and what I see in /var/log/messages is a ton of: r8169: eth0: link up r8169: eth0: link up r8169: eth0: link up 1. What does this mean? I can't ...
2
votes
1answer
163 views

How can I implement an ip whitelist to protect my server? [duplicate]

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
-1
votes
1answer
821 views

CentOS server RAM usage 100%

I am using Linux CentOS 5.8 VPS. But my site is so slow in last two days. When i cehcked in server's web control panel; RAM usage is 99-100 %. But when i write "top" command; there is any usage on ...
2
votes
3answers
1k views

Nginx and php-fpm fails with high load: “Possible SYN flooding on port 80” and “104: Connection reset by peer”

I have quite heavy loaded web server using: Ubuntu server nginx php-fpm + apc Yesterday something wierd happened with my server. It crashed and stopped responding and after I rebooted it, web pages ...
1
vote
3answers
179 views

DDOS protection from ISP side, UDP protocol, whitelist

Is it possible to ignore packets from ISP side which are incoming to my server? Is possible this kind of situation ? : I have white list of IP addresses. I continually update white list and sends it ...
2
votes
2answers
2k views

Tune Linux kernel against SYN flood attack

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile ...
10
votes
1answer
1k views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
-1
votes
1answer
760 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
8
votes
3answers
1k views

RedStation.com is heaven for ddos attackers, How to file complaint? [closed]

Sorry, I don't know where to open this subject. This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
1
vote
2answers
520 views

How can I prevent an unintentional DDOS running ColdFusion 8 with IIS 6?

We had an interesting outage today on one of our client's websites. Out of nowhere, the website was inaccessible. The website runs by itself on a dedicated physical Windows 2003 R2 server (probably ...
-2
votes
2answers
152 views

hardware antiddos solution [closed]

We have three servers on colo in datacenter for hi-load e-commerce web project connected via cisco catalyst 2960. We need to make antiddos system with hardware firewall, CISCO Guard etc. CISCO Guard ...
0
votes
1answer
44 views

My site is inaccessible from different locations on-and-off. What's happening?

On-and-off for the last few days, my sites (www.)aderet.org and to a lesser extent (www.)saveadullam.org have been down from (two different networks in) Israel. Over a period of minutes or seconds, ...
0
votes
1answer
176 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
1answer
201 views

Server Recovery from Denial of Service

I'm looking at a server that might be misconfigured to handle Denial of Service. The database was knocked offline after the attack, and was unable to restart itself after it failed to restart when the ...
5
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
1
vote
1answer
2k views

pfSense + DDoS Protection [duplicate]

I run a gaming community on a colo with a 100Mbps port. I want to buy a very cheap 35 dollar server with the same 100Mbps port, and run pfSense to use as a hardware firewall. I'm dealing with a bunch ...
1
vote
2answers
119 views

How can I determine the method of this DDoS attack? [duplicate]

My server went down earlier - looks like a DDoS. A spike in traffic to around 13mbit, the swap goes from idle to maxed in about 5 minutes, and server stops responding. I would like to protect ...
3
votes
1answer
732 views

iptables - drop all HTTP(S) traffic but from CloudFlare

I would like to allow only HTTP(S) traffic coming from CloudFlare. In that way attackers cannot attack the server directly. I know CloudFlare is not mainly a DDoS mitigator, but I would like to try ...
2
votes
1answer
477 views

Using Varnish (only) for DDoS mitigation [duplicate]

My VPS is suffering from a (D)DoS doing a SYN flood with spoofed IPs. I'm right now searching from ways how to be able to defend (at least a bit) against it. It's running a DirectAdmin apache2 ...
2
votes
2answers
115 views

how to track which switches, routers are being affected by ddos

I have an enterprise network system which has a router facing the internet, beneath it a virtual chassis switch, below it an access layer switch and finally a server. My question is that when there is ...
0
votes
4answers
2k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
9
votes
7answers
8k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
1
vote
1answer
390 views

Can you stop a SYN Flood attack with .htaccess?

[Linux - CentOS - Apache - VPS] Last week my servers came under a SYN Flood attack, my hosting provider took some steps and resolved the issue. One of the things that they did was turn on SYN ...
2
votes
1answer
2k views

Windows Server 2008: Limit UDP/TCP packets per IP or ban

How I can limit UDP/TCP packets per IP send to my host (or better PORT) per second or minute ? Would be nice to ban that IP for 12/24 hours or even for ever. I got Windows Server 2008 and I'm very ...
5
votes
3answers
1k views

How can I block a specific type of DDoS attack?

My site is being attacked and is using up all the RAM. I looked at the Apache logs and every malicious hit seems to simply be a POST request on /, which is never required by a normal user. So I ...
1
vote
0answers
54 views

Effective ways of mitigating Spoofed Syn Flood with iptables [duplicate]

Possible Duplicate: SYN Flood Advice Heyo, Been dealing alot with spoofed syn floods lately. Are there any tips or tricks we could do to better survive them? Syn Cookies are already ...
2
votes
1answer
644 views

Mitigate HTTP connect floods with HAproxy + Apache

Our infrastructure consists of load balancers running HAProxy and Apache, which forward traffic to our app servers running just Apache. The past few days, we've been seeing connection floods which the ...
1
vote
1answer
947 views

Protecting Apache and Nginx against slow read/write and similar attacks?

There are many articles explaining many ways to attack webservers (generic or specific) and even listing general rules for mitigating such attacks, e.g.: Do not accept connections with abnormally ...
12
votes
3answers
721 views

DNS down in Anonymous attack

As I'm writing this our company website and the web-service we developed are down in the big GoDaddy outage resulting from an Anonymous attack (or so says Twitter). We used GoDaddy as our registrar ...
0
votes
1answer
234 views

DDoS attacks to PBX [closed]

I'm wondering if DDOS attacks to PBX or telecommunications systems is possibe real. According to this links: ...
0
votes
1answer
579 views

*Simple* way to block DDoS by number of requests

I have 3 Varnish 3.0.2 servers with Apache 2 as backends, which are being load balanced through a HAproxy separate server. I need to find a very simple program (I'm not much of a sysadmin), which ...
1
vote
1answer
134 views

ip_conntrack ideal or not for server stability

By default the module ip_conntrack is installed into the kernel. My question is simple, is having ip_conntrack a performance booster for better tracking of connections? On VPS nodes they do not have ...
1
vote
1answer
549 views

Why is FunWebProducts flooding my server?

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible? 89.70.25.120 - - ...
2
votes
2answers
238 views

What happens if a server never receives the RST packet?

Someone recently decided to show me a POC of a new Denial of Service method using SYN/TCP he's figured out. I thought it was complete nonsense, but after explaining to him about SYN-SYN/ACK-RST, he ...
0
votes
1answer
807 views

mod evasive not working properly on ubuntu 10.04

I have an ubuntu 10.04 server where I installed mod_evasive using apt-get install libapache2-mod-evasive I already tried several configurations, the result stays the same. The blocking does work, ...
3
votes
1answer
77 views

Perform action based on load avg

I'm running some web applications on an debian server and have to struggle with ddos attacks sometimes. It's eating up all my resources and I can't ssh anymore into the server. An idea was to drop all ...
-2
votes
1answer
631 views

Possible form for a ddos attack? [duplicate]

I have kinda asked this before. I've set up a server that serves my website, dns and some gameservers. However, when I check my routers firewall log, I get alot of incoming UDP packets blocked on the ...
14
votes
9answers
6k views

Public Facing Recursive DNS Servers - iptables rules

We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks? The ...