A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

1
vote
1answer
84 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
1
vote
2answers
1k views

Varnish and Connection Flood (DoS - DDoS) [duplicate]

I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX ...
3
votes
1answer
175 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
1
vote
1answer
335 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
0answers
130 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
1answer
179 views

Dos/ Flood Lag even though Port not Saturated

My GameServers had been under some UDP Floods due to which they generated outputs to the attacker which gave the GameServers some huge lags. Thanks to friends at ServerFault that upon different kind ...
0
votes
2answers
3k views

How to block tcp-reset with iptables to combat DDoS attacks?

I have someone flooding me with random packets on random ports that are closed. My server is responding to this with tcp-reset packets I think which is chewing up the outbound bandwidth too. How do ...
0
votes
2answers
567 views

What is the best way to help stop DOS attacks

I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting ...
2
votes
2answers
612 views

Hardening Apache authentication to block brute force attacks (e.g. delay)

Is there a way to configure Apache to slow down login after failed attempts? It looks like it is not the default setting as already discussed here. On the other side it seems to be possible also ...
1
vote
1answer
253 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
446 views

Logging UDP flood DDOS attacks? [closed]

How do I log UDP flood DDOS attacks? Right now I am thinking about detecting if the server is receiving more than X megabytes per second for Y seconds, and then doing trafshow > logs.txt as root ...
0
votes
4answers
754 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
807 views

DDoS - How to detect an attacker IP address [duplicate]

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
3
votes
2answers
508 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
5answers
677 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
373 views

Protection against DOS kits (Gootkit)

I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk ...
-3
votes
1answer
217 views

server is being used for ddos attacks, any scripts to search for these? [closed]

One of our vps' on rackspace is being used for ddos'ing which means we have a vulnerability somewhere. Is there any ssh scripts or tools that can scan for scripts doing this?
0
votes
1answer
441 views

Why is nginx taking so long to reply? [duplicate]

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
1
vote
1answer
906 views

Amazon EC2 abuse [duplicate]

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
1
vote
1answer
210 views

Blocking connection based on HTTP header

I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks ...
0
votes
1answer
1k views

DDOS Mitigation for UDP Flood [duplicate]

We are currently under attack on one of our servers at a datacenter in Chicago. 1 gbps (peak) 600mbps average UDP flood port 80 (incoming) Consumed 20 TB bandwidth in 2.5 days We have 50TB of ...
0
votes
2answers
282 views

Locating Source of Inbound DDOS [duplicate]

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
0
votes
1answer
848 views

(D)DOS Deflate Bug/Alternative [closed]

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
5k views

How to find the connection time-out value in linux?

I am setting up a nginx webserver with php-fpm and (d)dos deflate to ban attacks. Now currently there is no traffic to my server at all, as i'm testing things. With this command i can see who is ...
0
votes
1answer
258 views

Very often database PostgreSQL for my webapp fails

I have web application like Nginx (proxy) + Tomcat (backend) + PostgreSQL (database). This web application is located on amazon free tier instance (http://aws.amazon.com/free/) and very often from ...
1
vote
2answers
371 views

DoS attack simulation vs real deal

There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be. What are the key differences between real vs ...
4
votes
2answers
8k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
4answers
300 views

How to set up notifications about server overload? [duplicate]

Possible Duplicate: What tool do you use to monitor your servers? How to get notified (preferably by email) when my webserver reaches certain amount of incoming requests? This way I'll be ...
2
votes
2answers
116 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
4answers
356 views

Apache getting DDoS [duplicate]

My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
23
votes
6answers
24k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
4
votes
2answers
782 views

Web site kills hard disk I/O, how to prevent?

The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
1
vote
2answers
577 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
5
votes
2answers
151 views

DDoS attack case study - Korean election watchdog's site [closed]

Is it possible to break only some of a web site services using DDoS? For example, disabling only the search feature of a specific website. I raise this question following a controversy in South ...
0
votes
1answer
280 views

Cloudflare performance, ddos [closed]

I have been using cloudflare CDN on my website (wordpress) for about 4 months, mostly because I was hoping the CDN would make things faster, and make the load on my cheap server somewhat smaller, ...
2
votes
2answers
699 views

DoS attack requesting single file on server, best way to overcome?

My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!). Sample from the access log: 186.92.86.149 - - ...
0
votes
1answer
186 views

Blocking all RIPE Addresses in Server 2008?

Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, ...
0
votes
1answer
263 views

Diagnosing DDOS after the fact

I manage the code and deployments for an ASP.net site on a dedicated server. Windows 2008-64 R2, 8GB RAM, Dual Core. It is a dedicated intranet site that never has much traffic. Most of the ...
0
votes
2answers
3k views

DNS Server Spoofed Request Amplification DDoS - Prevention

I've been conducting security scans, and a new one popped up for me: DNS Server Spoofed Request Amplification DDoS The remote DNS server answers to any request. It is possible to query the ...
4
votes
6answers
2k views

How to survive anonymous DDOS attack? [duplicate]

Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional. I read (basic theory) about dealing with normal DDOS ...
1
vote
2answers
243 views

Concerns about a Dedicated (Windows Server 2008) + DDoS [duplicate]

I am have today a dedicated server with these specs: Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3 And I would like to know what are the best ...
0
votes
3answers
92 views

Small unsustained ddos? [duplicate]

Recently, I have random occurence where I can't reach my server. When this occurs, about 1 ping on each 10 manage to ping back. The ping that do get through are within normal response time (about 42ms ...
4
votes
1answer
460 views

Block outgoing LOIC attacks in a network

I am admin of a small network. Users in our network have access to internet through a squid NAT server. Recently, we have detected that some users are using LOIC to attack servers on the internet. ...
-1
votes
1answer
513 views

My Linux server is thought to be under a DDOS attack and no access to SSH - what to do? [closed]

How can I fix the issues from a DDOS attack without any SSH access at all. My main domain is http://www.reddexservers.co.uk - is there any way of checking if it is under attack externally? Thanks!
2
votes
4answers
591 views

mod_rewrite and access.log

My site recently came under a DOS attack, which seems to have been mostly fixed by installing mod-evasive (which is fine) I wanted to find the IP which was used for the attack so naturally I went to ...
0
votes
2answers
634 views

IP Address filter 'before' http secured connections for protection against DDoS attacks? [duplicate]

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an ...