A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

2
votes
2answers
527 views

Hardening Apache authentication to block brute force attacks (e.g. delay)

Is there a way to configure Apache to slow down login after failed attempts? It looks like it is not the default setting as already discussed here. On the other side it seems to be possible also ...
1
vote
1answer
237 views

How to find malicious IPs?

Cacti shows irregular and pretty steady high bandwidth to my server (40x the normal) so I guess the server is udnder some sort of DDoS attack. The incoming bandwidth has not paralyzed my server, but ...
1
vote
1answer
398 views

Logging UDP flood DDOS attacks? [closed]

How do I log UDP flood DDOS attacks? Right now I am thinking about detecting if the server is receiving more than X megabytes per second for Y seconds, and then doing trafshow > logs.txt as root ...
0
votes
4answers
711 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
713 views

DDoS - How to detect an attacker IP address [duplicate]

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
3
votes
2answers
489 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
5answers
606 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
367 views

Protection against DOS kits (Gootkit)

I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk ...
-3
votes
1answer
209 views

server is being used for ddos attacks, any scripts to search for these? [closed]

One of our vps' on rackspace is being used for ddos'ing which means we have a vulnerability somewhere. Is there any ssh scripts or tools that can scan for scripts doing this?
0
votes
1answer
405 views

Why is nginx taking so long to reply? [duplicate]

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; ...
1
vote
1answer
710 views

Amazon EC2 abuse [duplicate]

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
1
vote
1answer
208 views

Blocking connection based on HTTP header

I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks ...
0
votes
1answer
771 views

DDOS Mitigation for UDP Flood [duplicate]

We are currently under attack on one of our servers at a datacenter in Chicago. 1 gbps (peak) 600mbps average UDP flood port 80 (incoming) Consumed 20 TB bandwidth in 2.5 days We have 50TB of ...
0
votes
2answers
262 views

Locating Source of Inbound DDOS [duplicate]

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
0
votes
1answer
616 views

(D)DOS Deflate Bug/Alternative [closed]

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
4k views

How to find the connection time-out value in linux?

I am setting up a nginx webserver with php-fpm and (d)dos deflate to ban attacks. Now currently there is no traffic to my server at all, as i'm testing things. With this command i can see who is ...
0
votes
1answer
219 views

Very often database PostgreSQL for my webapp fails

I have web application like Nginx (proxy) + Tomcat (backend) + PostgreSQL (database). This web application is located on amazon free tier instance (http://aws.amazon.com/free/) and very often from ...
1
vote
2answers
345 views

DoS attack simulation vs real deal

There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be. What are the key differences between real vs ...
4
votes
2answers
6k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
4answers
276 views

How to set up notifications about server overload? [duplicate]

Possible Duplicate: What tool do you use to monitor your servers? How to get notified (preferably by email) when my webserver reaches certain amount of incoming requests? This way I'll be ...
2
votes
2answers
116 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
4answers
331 views

Apache getting DDoS [duplicate]

My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
18
votes
4answers
19k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
4
votes
2answers
722 views

Web site kills hard disk I/O, how to prevent?

The situation: I have a server, on which we have 2-3 projects. Starting not long ago, the server started hanging up (We could not connect to it by ssh, and the connected clients had to wait 20 minutes ...
1
vote
2answers
494 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
5
votes
2answers
147 views

DDoS attack case study - Korean election watchdog's site [closed]

Is it possible to break only some of a web site services using DDoS? For example, disabling only the search feature of a specific website. I raise this question following a controversy in South ...
0
votes
1answer
266 views

Cloudflare performance, ddos [closed]

I have been using cloudflare CDN on my website (wordpress) for about 4 months, mostly because I was hoping the CDN would make things faster, and make the load on my cheap server somewhat smaller, ...
2
votes
2answers
656 views

DoS attack requesting single file on server, best way to overcome?

My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!). Sample from the access log: 186.92.86.149 - - ...
0
votes
1answer
169 views

Blocking all RIPE Addresses in Server 2008?

Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, ...
0
votes
1answer
235 views

Diagnosing DDOS after the fact

I manage the code and deployments for an ASP.net site on a dedicated server. Windows 2008-64 R2, 8GB RAM, Dual Core. It is a dedicated intranet site that never has much traffic. Most of the ...
0
votes
2answers
2k views

DNS Server Spoofed Request Amplification DDoS - Prevention

I've been conducting security scans, and a new one popped up for me: DNS Server Spoofed Request Amplification DDoS The remote DNS server answers to any request. It is possible to query the ...
4
votes
6answers
2k views

How to survive anonymous DDOS attack? [duplicate]

Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional. I read (basic theory) about dealing with normal DDOS ...
1
vote
2answers
227 views

Concerns about a Dedicated (Windows Server 2008) + DDoS [duplicate]

I am have today a dedicated server with these specs: Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3 And I would like to know what are the best ...
0
votes
3answers
92 views

Small unsustained ddos? [duplicate]

Recently, I have random occurence where I can't reach my server. When this occurs, about 1 ping on each 10 manage to ping back. The ping that do get through are within normal response time (about 42ms ...
4
votes
1answer
424 views

Block outgoing LOIC attacks in a network

I am admin of a small network. Users in our network have access to internet through a squid NAT server. Recently, we have detected that some users are using LOIC to attack servers on the internet. ...
-1
votes
1answer
458 views

My Linux server is thought to be under a DDOS attack and no access to SSH - what to do? [closed]

How can I fix the issues from a DDOS attack without any SSH access at all. My main domain is http://www.reddexservers.co.uk - is there any way of checking if it is under attack externally? Thanks!
2
votes
4answers
537 views

mod_rewrite and access.log

My site recently came under a DOS attack, which seems to have been mostly fixed by installing mod-evasive (which is fine) I wanted to find the IP which was used for the attack so naturally I went to ...
0
votes
2answers
540 views

IP Address filter 'before' http secured connections for protection against DDoS attacks? [duplicate]

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an ...
3
votes
2answers
2k views

How to block null/blank user-agents in IIS 7.5

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it. Here ...
1
vote
2answers
929 views

What “Syn Proxy Servers” are recommended? Or how to build one?

My questions are: 1.) What is a recommended "SYN PROXY SERVER" to filter bogus SYN Attacks and only forward "handshaked" valid connections to the host behind it (to be protected). I search the term, ...
4
votes
5answers
1k views

My server was reported to hoster abuse to perform ddos attacks. What should I do?

I do not see anything suspicious on the server (no netstat connections to remote 80 port), but I'm not a professional server admin (I'm a hardcore software developer). Please do not write obvious ...
0
votes
3answers
5k views

Block All UDP traffic (to prevent ddos) [duplicate]

I have been receiving countless ddos attacks the last couple of weeks. Just now I caught one while I was running iptraf. Normally 99.9% of the packets used on my server are TCP packages, and not UDP. ...
4
votes
3answers
740 views

100mb/s upgrade to 1gbps network - To Prevent DDOS [duplicate]

I have been under constant DDOS attack the last couple of weeks. Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages. I run ...
0
votes
1answer
779 views

Multiple DDOS attacks per day [duplicate]

I run a popular tech website, and for weeks my site has been under DDOS attacks. The attacks happen at random times, and often about 10 times per day. Usually the attacks only last a few minutes, then ...
0
votes
0answers
684 views

Please, help with nginx! blocking requests with part url [closed]

Please, help! My site is under DDoS attack now. Attackers load page: /?p={RANDOM_NUMBER}http://antijob.anho.org/ How to block all requests with it? Trying: location / { if ( $args = '' ) { ...
0
votes
1answer
176 views

My website keeps being hit by iPhones…am I being DDOSed?

66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" ...
2
votes
3answers
812 views

Am I getting DDoSed, and what should I about it?

At the moment my server is lagging pretty bad, and it crashes. It's a dedicated server which has run completely fine last two days. What does this command do? netstat -n|grep :80|cut -c 45-|cut -f 1 ...