A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
4answers
1k views

How to tune Linux kernel to withstand DDoS? (HAProxy)

Please do not reply with "this is not possible", as it's waste of time. I am developing cloud appliance and I have a valid reason to protect this layer against DDoS, and there are few companies doing ...
3
votes
2answers
1k views

Can DDoS be stopped with BGP? [duplicate]

When I am experiencing DDoS @10Gbps, if I have BGP router with 10M table entries in it, can I perform search on the offensive network? I would do this the way, that first I would remove routing to me ...
1
vote
4answers
9k views

How to prevent DDOS syn attack [duplicate]

I am running a site with 2 GB ram on centos. Using LAMP Everyday for a few hours (about 3 to 4 hours) apache goes down. It takes too long to load a page and most of time it shows Request time out. ...
3
votes
1answer
9k views

How can I detect a DDoS attack using pfSense so I can tell my ISP who to block? [duplicate]

Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host. I understand (from this ...
0
votes
1answer
76 views

DNS workaround for webhost DDoS [duplicate]

My webhoster seems to have some troubles with DDOS attacks and routing overload. This makes my IP to be not available sometimes and I'd like to add a failover IP for the domain. However, 2 A-Records ...
1
vote
1answer
547 views

DROP vs REJECT DDoS [duplicate]

I asked somewhere else, and I got this response: Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine ...
0
votes
2answers
870 views

Monitor incoming TCP/UDP flood attack and graph it

I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results. I have some VPSes that will perform ...
-1
votes
3answers
9k views

iptables rules to counter the most common DoS attacks? [closed]

Recently I've got a lot of small scale DoS attacks. I am wondering what iptables rules should I use to counter the most common DoS attacks, and generally secure my web server. The web server sports ...
1
vote
2answers
895 views

Debian iptables, netstate. DDOS? [duplicate]

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
0
votes
1answer
4k views

How to know which site/script is taking all CPU and RAM in Plesk/apache

I have more than 100+ domains on a CentOS Plesk server. Suddenly the load on the server goes very high and eats up all resources. eating up all RAM, all CPU , due to which i cannot even login to ...
2
votes
1answer
306 views

Redundant Router and Load Balancing vs. DDoS attack [duplicate]

With a small server farm at a hoster with great support and conditions, I worry about the increasing number of DDoS attacks against this hoster (not my web project, but other clients on the same ...
0
votes
1answer
5k views

DDOS Attack detection with netstat [duplicate]

I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP. netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
3
votes
4answers
4k views

EC2 ELB and DOS attacks

I'm using Amazon's ELB to load balance between servers, When my site is under attack by bots, everything is exhausted, so here is the problem I can't block IP addresses with Amazon's security ...
0
votes
1answer
1k views

Best Practice for captcha based protection against D.O.S to Nginx Proxy [duplicate]

The idea is explained here In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers. If the number of request times within a certain period from ...
0
votes
1answer
426 views

DDos attack filter [duplicate]

Im running a debian linux VPS server with a garrysmod server. Today I've recieved a ddos attack and I could log by using tshark the next: 4.213248 91.204.63.5 -> 176.58.101.xx UDP Source port: ...
0
votes
3answers
2k views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
-2
votes
2answers
208 views

Nginx massive error.log, am I being DDOSed?

So I just opened up my Nginx error log as all my pages are throwing error code 500. It's enormous, my site is still in development and their are well over 100k errors for resources Nginx was unable ...
-1
votes
1answer
353 views

Linux tools to choose suitable Cisco ASA 5500 [closed]

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
-4
votes
3answers
361 views

How do i mitigate DDOS attacks on static servers? [duplicate]

Here is a slightly different take on DDOS attacks. Rather than a server with dynamic content being attack i was curious how to deal with attacks on servers with STATIC CONTENT. This means cpu tends to ...
-6
votes
1answer
183 views

What are some acceptable easy solutions against DDOS? [duplicate]

IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd). Would changing ...
4
votes
2answers
519 views

Is it possible to find the actual source IP of a packet with a spoofed IP header?

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?
0
votes
2answers
1k views

Protecting against DDoS attacks? [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm running a private http server to power a private website. The IP of the server has gone public, thats fine. Nothing to hide anyway. The ...
0
votes
2answers
582 views

Prevent scanning of the Apache's /default directory [duplicate]

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is ...
-1
votes
2answers
702 views

DDOS Attacks Explanation [closed]

I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me . Questions : what are the ...
1
vote
1answer
85 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
1
vote
2answers
2k views

Varnish and Connection Flood (DoS - DDoS) [duplicate]

I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
3
votes
1answer
185 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
1
vote
1answer
354 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
0answers
132 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
1answer
181 views

Dos/ Flood Lag even though Port not Saturated

My GameServers had been under some UDP Floods due to which they generated outputs to the attacker which gave the GameServers some huge lags. Thanks to friends at ServerFault that upon different kind ...
0
votes
2answers
3k views

How to block tcp-reset with iptables to combat DDoS attacks?

I have someone flooding me with random packets on random ports that are closed. My server is responding to this with tcp-reset packets I think which is chewing up the outbound bandwidth too. How do ...
0
votes
2answers
579 views

What is the best way to help stop DOS attacks

I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting ...
2
votes
2answers
639 views

Hardening Apache authentication to block brute force attacks (e.g. delay)

Is there a way to configure Apache to slow down login after failed attempts? It looks like it is not the default setting as already discussed here. On the other side it seems to be possible also ...
1
vote
1answer
265 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
0
votes
4answers
833 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
874 views

DDoS - How to detect an attacker IP address [duplicate]

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
3
votes
2answers
521 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
5answers
743 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
380 views

Protection against DOS kits (Gootkit)

I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk ...
-3
votes
1answer
217 views

server is being used for ddos attacks, any scripts to search for these? [closed]

One of our vps' on rackspace is being used for ddos'ing which means we have a vulnerability somewhere. Is there any ssh scripts or tools that can scan for scripts doing this?
0
votes
1answer
3k views

Iptables ratelimit UDP DOS attacks [duplicate]

Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way, Attackers are ...
0
votes
1answer
474 views

Why is nginx taking so long to reply? [duplicate]

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
1
vote
1answer
1k views

Amazon EC2 abuse [duplicate]

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
1
vote
1answer
219 views

Blocking connection based on HTTP header

I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks ...
0
votes
1answer
1k views

DDOS Mitigation for UDP Flood [duplicate]

We are currently under attack on one of our servers at a datacenter in Chicago. 1 gbps (peak) 600mbps average UDP flood port 80 (incoming) Consumed 20 TB bandwidth in 2.5 days We have 50TB of ...
0
votes
2answers
300 views

Locating Source of Inbound DDOS [duplicate]

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
2
votes
2answers
226 views

Monitor DoS attack with snmp [closed]

Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?
0
votes
1answer
1k views

(D)DOS Deflate Bug/Alternative [closed]

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...