A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

1
vote
2answers
2k views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-1
votes
1answer
273 views

Can the netstat command show what specific website a user is on? [closed]

I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I ...
0
votes
3answers
530 views

Can you block an ip with multiple connections? (Apache ddos attack)

My server is under a Apache ddos attack right now. There's a ton of single ip addresses with 30+ connections. When I use this SSH command: netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk -F':...
-1
votes
2answers
393 views

Router DDoS Protection by MAC [duplicate]

I was wondering if there are any DDoS defences where a (any) router will block all packets (for any period of time) from the MAC address of its attacker. If so, under what circumstances would this ...
2
votes
0answers
79 views

How to prevent HTTP-based DDoS attacks [duplicate]

This night, I've noticed nginx was not responding to requests. After some investigation, I found that it was using 100% of the CPU and error.log was full of messages like this one: 2013/05/28 00:11:...
0
votes
1answer
81 views

Send mails from secondary server

Problem: When I send an email from my server, the email headers contain the IP address of the server. Yeah, this is a problem, because the server is being the target of DDoS attacks. Using CloudFlare ...
0
votes
1answer
966 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
0
votes
1answer
653 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
2
votes
1answer
2k views

Nginx - Redirect request by GET parameters pattern

One of my servers was attacked by DDoS a couple of days ago and it lasted for 4 days. Below are the logs snippet of the request: 36.224.180.253 - - [14/May/2013:03:11:46 +0800] "GET //?f5b2fd2f860dc=...
3
votes
1answer
239 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive (...
2
votes
1answer
10k views

How to configure mod_reqtimeout in Apache2

I need to configure mod_reqtimeout in my Apache server v2.2.22 (in a linux machine). Problem is, I have absolutely no clue on how to do it. I checked the Apache site on this module at this link but ...
0
votes
1answer
389 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
4
votes
1answer
306 views

Windows server 2008, a very small DDoS is able to kill my server [duplicate]

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 Mbps ...
0
votes
1answer
1k views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
401 views

Parse Apache logfile and ban IPs

My server is under attack, it is flooded with request with the following pattern: Thousands of IPs Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
-1
votes
1answer
737 views

Any way to Improve performance of iptables DDOS whitelist? [closed]

I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
2answers
897 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
1answer
3k views

ICMP time exceeded in-transit

In the last few days my server suffers an attack of this kind: (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs) tcpdump -n proto ICMP 17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
1answer
490 views

Find IP addresses with most connections on system

I am currently experiencing some attacks on my OpenVZ server (CentOS 6.3 64bit), which is saturating the public ethernet interface (currently accessing SSH via the private interface). Is it possible ...
0
votes
2answers
96 views

Will I get banned or blocked for running a diagnostic app?

This may seem like a simple question. Hopefully it will have a simple answer. I run an internet radio station. There are 3 machines. Music source client Stage server Master server (relays the ...
0
votes
1answer
437 views

Lot of Apache requests in “L” state, what could be the reason? DDOS?

I am having this in my apache server status message: LLLLLLLLLLLLLLLWLLLLLLLLWLLLLLWLLLLLLLLLLWLLLLLLLWLLLLLLLLLLLLLL WLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLWLWLLLLLLLLL ...
0
votes
3answers
983 views

iptables rule to stop DDOS [duplicate]

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
0
votes
3answers
607 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
0answers
300 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...
4
votes
1answer
1k views

iptables, what to open on INPUT for wget

I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
0
votes
1answer
175 views

ssyn.c and slow.c used on my VPS [duplicate]

I have noticed some changes on VPS Debian Squeeze and looked with history to see what commands were run. Then I found some which I'm 100% sure I didn't run because I don't know what are they. Somebody ...
0
votes
1answer
178 views

Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]

I have a non-Xen VPS (don't exactly know what the software is). The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
1answer
447 views

Cisco ACL Block by Packet Length

I am presently blocking a small scale DDOS attack using IP addresses but all the packets are the same size, 1514 bits and I kind of don't want to fill up an ACL rule with a bunch of IPs. After reading ...
1
vote
2answers
483 views

PHP web hosting: how to prevent clients to DOS/DDOS? [duplicate]

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts. Besides the security routine I'll have to check (off topic here) I would like to know ...
0
votes
2answers
3k views

Detect process that is doing an outbound DDoS attack [duplicate]

My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the ...
2
votes
1answer
2k views

How do I drop “empty” HTTP packets using iptables? [duplicate]

I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
0
votes
2answers
927 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
15
votes
4answers
2k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
2answers
427 views

netfilter ip_conntrack and (d)DoS [duplicate]

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
2
votes
1answer
658 views

Spoofed DDoS protection strategy, filter window size == 0?

I was hit by a SYN flood that nearly killed the network stack of my ipvs loadbalancer (80K packets/sec). The "ksoftirqd" process took 100% CPU, the machine was nearly unresponsive from the network. A ...
0
votes
2answers
419 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos 0x0,...
-2
votes
2answers
657 views

Determine packets per second [closed]

What is an ideal way to get the number of packets per second on a Linux box? Would I use tcpdump or are there better methods?
2
votes
1answer
336 views

Mitigate DDoS Proxy attack [duplicate]

In last days my apache is being attacked by many connections from proxies. I've identified the source but could not block the attack effectively. The attacker seems to be using pyloris or a variation ...
0
votes
1answer
316 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET /topic?...
0
votes
2answers
1k views

what does “eth0: link up” mean? /var/log/messages

My server is being attacked (SYN flood attack) and what I see in /var/log/messages is a ton of: r8169: eth0: link up r8169: eth0: link up r8169: eth0: link up 1. What does this mean? I can't ...
2
votes
1answer
318 views

How can I implement an ip whitelist to protect my server? [duplicate]

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
-1
votes
1answer
1k views

CentOS server RAM usage 100%

I am using Linux CentOS 5.8 VPS. But my site is so slow in last two days. When i cehcked in server's web control panel; RAM usage is 99-100 %. But when i write "top" command; there is any usage on RAM....
2
votes
3answers
1k views

Nginx and php-fpm fails with high load: “Possible SYN flooding on port 80” and “104: Connection reset by peer”

I have quite heavy loaded web server using: Ubuntu server nginx php-fpm + apc Yesterday something wierd happened with my server. It crashed and stopped responding and after I rebooted it, web pages ...
1
vote
3answers
199 views

DDOS protection from ISP side, UDP protocol, whitelist

Is it possible to ignore packets from ISP side which are incoming to my server? Is possible this kind of situation ? : I have white list of IP addresses. I continually update white list and sends it ...
2
votes
2answers
4k views

Tune Linux kernel against SYN flood attack

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile ...
10
votes
1answer
2k views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
-1
votes
1answer
1k views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
8
votes
3answers
1k views

RedStation.com is heaven for ddos attackers, How to file complaint? [closed]

Sorry, I don't know where to open this subject. This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
1
vote
2answers
637 views

How can I prevent an unintentional DDOS running ColdFusion 8 with IIS 6?

We had an interesting outage today on one of our client's websites. Out of nowhere, the website was inaccessible. The website runs by itself on a dedicated physical Windows 2003 R2 server (probably ...
-2
votes
2answers
163 views

hardware antiddos solution [closed]

We have three servers on colo in datacenter for hi-load e-commerce web project connected via cisco catalyst 2960. We need to make antiddos system with hardware firewall, CISCO Guard etc. CISCO Guard ...