A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
1answer
4k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
3
votes
4answers
4k views

EC2 ELB and DOS attacks

I'm using Amazon's ELB to load balance between servers, When my site is under attack by bots, everything is exhausted, so here is the problem I can't block IP addresses with Amazon's security ...
0
votes
1answer
1k views

Best Practice for captcha based protection against D.O.S to Nginx Proxy [duplicate]

The idea is explained here In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers. If the number of request times within a certain period from ...
0
votes
1answer
423 views

DDos attack filter [duplicate]

Im running a debian linux VPS server with a garrysmod server. Today I've recieved a ddos attack and I could log by using tshark the next: 4.213248 91.204.63.5 -> 176.58.101.xx UDP Source port: ...
0
votes
3answers
2k views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
-2
votes
2answers
202 views

Nginx massive error.log, am I being DDOSed?

So I just opened up my Nginx error log as all my pages are throwing error code 500. It's enormous, my site is still in development and their are well over 100k errors for resources Nginx was unable ...
-1
votes
1answer
335 views

Linux tools to choose suitable Cisco ASA 5500 [closed]

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
-4
votes
3answers
334 views

How do i mitigate DDOS attacks on static servers? [duplicate]

Here is a slightly different take on DDOS attacks. Rather than a server with dynamic content being attack i was curious how to deal with attacks on servers with STATIC CONTENT. This means cpu tends to ...
-6
votes
1answer
183 views

What are some acceptable easy solutions against DDOS? [duplicate]

IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd). Would changing ...
4
votes
2answers
513 views

Is it possible to find the actual source IP of a packet with a spoofed IP header?

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
0
votes
2answers
1k views

Protecting against DDoS attacks? [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm running a private http server to power a private website. The IP of the server has gone public, thats fine. Nothing to hide anyway. The ...
0
votes
2answers
541 views

Prevent scanning of the Apache's /default directory [duplicate]

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is ...
-1
votes
2answers
687 views

DDOS Attacks Explanation [closed]

I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me . Questions : what are the ...
1
vote
1answer
85 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
1
vote
2answers
2k views

Varnish and Connection Flood (DoS - DDoS) [duplicate]

I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
3
votes
1answer
182 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
1
vote
1answer
342 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
0answers
131 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
1answer
180 views

Dos/ Flood Lag even though Port not Saturated

My GameServers had been under some UDP Floods due to which they generated outputs to the attacker which gave the GameServers some huge lags. Thanks to friends at ServerFault that upon different kind ...
0
votes
2answers
3k views

How to block tcp-reset with iptables to combat DDoS attacks?

I have someone flooding me with random packets on random ports that are closed. My server is responding to this with tcp-reset packets I think which is chewing up the outbound bandwidth too. How do ...
0
votes
2answers
576 views

What is the best way to help stop DOS attacks

I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting ...
2
votes
2answers
629 views

Hardening Apache authentication to block brute force attacks (e.g. delay)

Is there a way to configure Apache to slow down login after failed attempts? It looks like it is not the default setting as already discussed here. On the other side it seems to be possible also ...
1
vote
1answer
259 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
0
votes
4answers
790 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
844 views

DDoS - How to detect an attacker IP address [duplicate]

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
3
votes
2answers
516 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
5answers
709 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
378 views

Protection against DOS kits (Gootkit)

I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk ...
-3
votes
1answer
217 views

server is being used for ddos attacks, any scripts to search for these? [closed]

One of our vps' on rackspace is being used for ddos'ing which means we have a vulnerability somewhere. Is there any ssh scripts or tools that can scan for scripts doing this?
0
votes
1answer
3k views

Iptables ratelimit UDP DOS attacks [duplicate]

Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way, Attackers are ...
0
votes
1answer
454 views

Why is nginx taking so long to reply? [duplicate]

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
1
vote
1answer
963 views

Amazon EC2 abuse [duplicate]

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
1
vote
1answer
216 views

Blocking connection based on HTTP header

I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks ...
0
votes
1answer
1k views

DDOS Mitigation for UDP Flood [duplicate]

We are currently under attack on one of our servers at a datacenter in Chicago. 1 gbps (peak) 600mbps average UDP flood port 80 (incoming) Consumed 20 TB bandwidth in 2.5 days We have 50TB of ...
0
votes
2answers
295 views

Locating Source of Inbound DDOS [duplicate]

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
2
votes
2answers
221 views

Monitor DoS attack with snmp [closed]

Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?
0
votes
1answer
934 views

(D)DOS Deflate Bug/Alternative [closed]

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
5k views

How to find the connection time-out value in linux?

I am setting up a nginx webserver with php-fpm and (d)dos deflate to ban attacks. Now currently there is no traffic to my server at all, as i'm testing things. With this command i can see who is ...
0
votes
1answer
277 views

Very often database PostgreSQL for my webapp fails

I have web application like Nginx (proxy) + Tomcat (backend) + PostgreSQL (database). This web application is located on amazon free tier instance (http://aws.amazon.com/free/) and very often from ...
1
vote
2answers
379 views

DoS attack simulation vs real deal

There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be. What are the key differences between real vs ...
4
votes
2answers
8k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
4answers
346 views

How to set up notifications about server overload? [duplicate]

Possible Duplicate: What tool do you use to monitor your servers? How to get notified (preferably by email) when my webserver reaches certain amount of incoming requests? This way I'll be ...
2
votes
2answers
117 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
4answers
368 views

Apache getting DDoS [duplicate]

My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
24
votes
6answers
27k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
4
votes
2answers
793 views

Web site kills hard disk I/O, how to prevent?

The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
1
vote
2answers
600 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...