A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

-2
votes
2answers
201 views

Nginx massive error.log, am I being DDOSed?

So I just opened up my Nginx error log as all my pages are throwing error code 500. It's enormous, my site is still in development and their are well over 100k errors for resources Nginx was unable ...
-1
votes
1answer
326 views

Linux tools to choose suitable Cisco ASA 5500 [closed]

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
-4
votes
3answers
333 views

How do i mitigate DDOS attacks on static servers? [duplicate]

Here is a slightly different take on DDOS attacks. Rather than a server with dynamic content being attack i was curious how to deal with attacks on servers with STATIC CONTENT. This means cpu tends to ...
-6
votes
1answer
183 views

What are some acceptable easy solutions against DDOS? [duplicate]

IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd). Would changing ...
4
votes
2answers
511 views

Is it possible to find the actual source IP of a packet with a spoofed IP header?

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
0
votes
2answers
1k views

Protecting against DDoS attacks? [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm running a private http server to power a private website. The IP of the server has gone public, thats fine. Nothing to hide anyway. The ...
0
votes
2answers
529 views

Prevent scanning of the Apache's /default directory

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is ...
-1
votes
2answers
683 views

DDOS Attacks Explanation [closed]

I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me . Questions : what are the ...
1
vote
1answer
85 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
1
vote
2answers
2k views

Varnish and Connection Flood (DoS - DDoS) [duplicate]

I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
3
votes
1answer
180 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
1
vote
1answer
339 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
0answers
131 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
1answer
180 views

Dos/ Flood Lag even though Port not Saturated

My GameServers had been under some UDP Floods due to which they generated outputs to the attacker which gave the GameServers some huge lags. Thanks to friends at ServerFault that upon different kind ...
0
votes
2answers
3k views

How to block tcp-reset with iptables to combat DDoS attacks?

I have someone flooding me with random packets on random ports that are closed. My server is responding to this with tcp-reset packets I think which is chewing up the outbound bandwidth too. How do ...
0
votes
2answers
573 views

What is the best way to help stop DOS attacks

I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting ...
2
votes
2answers
620 views

Hardening Apache authentication to block brute force attacks (e.g. delay)

Is there a way to configure Apache to slow down login after failed attempts? It looks like it is not the default setting as already discussed here. On the other side it seems to be possible also ...
1
vote
1answer
259 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
460 views

Logging UDP flood DDOS attacks? [closed]

How do I log UDP flood DDOS attacks? Right now I am thinking about detecting if the server is receiving more than X megabytes per second for Y seconds, and then doing trafshow > logs.txt as root ...
0
votes
4answers
776 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
830 views

DDoS - How to detect an attacker IP address [duplicate]

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
3
votes
2answers
511 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
5answers
696 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
375 views

Protection against DOS kits (Gootkit)

I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk ...
-3
votes
1answer
217 views

server is being used for ddos attacks, any scripts to search for these? [closed]

One of our vps' on rackspace is being used for ddos'ing which means we have a vulnerability somewhere. Is there any ssh scripts or tools that can scan for scripts doing this?
0
votes
1answer
449 views

Why is nginx taking so long to reply? [duplicate]

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
1
vote
1answer
945 views

Amazon EC2 abuse [duplicate]

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
1
vote
1answer
215 views

Blocking connection based on HTTP header

I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks ...
0
votes
1answer
1k views

DDOS Mitigation for UDP Flood [duplicate]

We are currently under attack on one of our servers at a datacenter in Chicago. 1 gbps (peak) 600mbps average UDP flood port 80 (incoming) Consumed 20 TB bandwidth in 2.5 days We have 50TB of ...
0
votes
2answers
292 views

Locating Source of Inbound DDOS [duplicate]

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
0
votes
1answer
902 views

(D)DOS Deflate Bug/Alternative [closed]

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
5k views

How to find the connection time-out value in linux?

I am setting up a nginx webserver with php-fpm and (d)dos deflate to ban attacks. Now currently there is no traffic to my server at all, as i'm testing things. With this command i can see who is ...
0
votes
1answer
271 views

Very often database PostgreSQL for my webapp fails

I have web application like Nginx (proxy) + Tomcat (backend) + PostgreSQL (database). This web application is located on amazon free tier instance (http://aws.amazon.com/free/) and very often from ...
1
vote
2answers
374 views

DoS attack simulation vs real deal

There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be. What are the key differences between real vs ...
4
votes
2answers
8k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
4answers
318 views

How to set up notifications about server overload? [duplicate]

Possible Duplicate: What tool do you use to monitor your servers? How to get notified (preferably by email) when my webserver reaches certain amount of incoming requests? This way I'll be ...
2
votes
2answers
117 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
4answers
365 views

Apache getting DDoS [duplicate]

My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
24
votes
6answers
26k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
4
votes
2answers
789 views

Web site kills hard disk I/O, how to prevent?

The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
1
vote
2answers
593 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
5
votes
2answers
151 views

DDoS attack case study - Korean election watchdog's site [closed]

Is it possible to break only some of a web site services using DDoS? For example, disabling only the search feature of a specific website. I raise this question following a controversy in South ...
0
votes
1answer
286 views

Cloudflare performance, ddos [closed]

I have been using cloudflare CDN on my website (wordpress) for about 4 months, mostly because I was hoping the CDN would make things faster, and make the load on my cheap server somewhat smaller, ...
2
votes
2answers
713 views

DoS attack requesting single file on server, best way to overcome?

My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!). Sample from the access log: 186.92.86.149 - - ...
0
votes
1answer
190 views

Blocking all RIPE Addresses in Server 2008?

Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, ...
0
votes
1answer
268 views

Diagnosing DDOS after the fact

I manage the code and deployments for an ASP.net site on a dedicated server. Windows 2008-64 R2, 8GB RAM, Dual Core. It is a dedicated intranet site that never has much traffic. Most of the ...