Questions tagged [ddos]
A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
628
questions
-1
votes
3
answers
701
views
How to fight request spam (DDOS i guess) on CentOS server [duplicate]
lately i'm trying to fight DDOS on my CentOS 6.4 server. I have installed CSF and I've set it quite strictly. Yet there is a URL that have like 1000 requests and max 2 per IP (smart ddos-er I guess).
...
- 1,355
0
votes
2
answers
638
views
What is the best way to help stop DOS attacks
I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting ...
- 151
0
votes
2
answers
2k
views
Denial of Service coming from Facebook IP addresses
We have a website which appeared to suffer from a denial of service attack. There were several IP addresses involved and these were all registered to Facebook.
Here's an excerpt from the Apache log ...
- 136
-1
votes
1
answer
194
views
GRE tunnel / Route traffic based on which domain the user is trying to access
Imagine this kind of setup. 5 servers. 1 server will be the "front-end", all the traffic has to go through it first before going to the 4 other servers.
I don't want people to know the IPs of the ...
- 25.3k
1
vote
1
answer
760
views
How can I limit Googlebot's crawl rate?
I have a problem with one of my servers. Google opens lots of http connections to the apache server and basically performs a slowloris attack.
This netstat call results in the following output
...
CommunityBot
- 1
5
votes
3
answers
1k
views
100mb/s upgrade to 1gbps network - To Prevent DDOS [duplicate]
I have been under constant DDOS attack the last couple of weeks.
Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages.
I run ...
- 27.6k
1
vote
1
answer
1k
views
Ddos attack getting through iptables [duplicate]
I have been using my own self-made "iptables rules" for blocking all the major type of DDOS attacks on game-servers because these attacks were application/game-server specific instead of the general ...
- 437
0
votes
3
answers
779
views
How to handle a DDoS attack on a search engine? [duplicate]
We are running a search engine and are seeing a huge amount of fake search queries coming in over the last days from thousands of IP addresses. There is no real pattern in terms of queries text or IP ...
- 4,677
0
votes
1
answer
375
views
How to stop DDOS from unique ip addresses? [duplicate]
I have a problem with a LAMP server where Apache keeps getting lots of request "POST / HTTP/1.1" but always from new IP addresses. Blocking the IPs using iptables obviously won't help. Any ideas how ...
- 4,185
1
vote
1
answer
74
views
Under attack what source url source would this be? [duplicate]
We are under attack since about 2 weeks now and did as much as we can to protect oursefs. mod_reqtimeout is doing the job now but I am confused as what is it that they are hiting
I found this post
...
CommunityBot
- 1
4
votes
2
answers
663
views
How to prevent DDoS attacks? [duplicate]
I am a creator of a flash game server. I use cloudflare for my site, however the game tcp server cant be protected by CloudFlare. For about 2 months some person DDoSes my game using direct ip. Every ...
- 4,455
0
votes
1
answer
145
views
DDOS on Mail server? [duplicate]
My server has been down most of the day, running top shows several Apache processes (httpd) each one using 70% or more of the CPU, and MySql eating almost all memory.
I have tried rebooting the ...
- 129
2
votes
3
answers
693
views
ddos protection for dedicated server [duplicate]
Whats the best way to protect a linux root server from a ddos attack?
I just want to inform myself about the issue. I'm wondering I haven't found a good solution.
anybody has one?
thanks!
- 124
1
vote
2
answers
3k
views
what does "eth0: link up" mean? /var/log/messages
My server is being attacked (SYN flood attack) and what I see in /var/log/messages is a ton of:
r8169: eth0: link up
r8169: eth0: link up
r8169: eth0: link up
1. What does this mean?
I can't ...
- 133
2
votes
1
answer
333
views
How to prevent Skype DDOS [duplicate]
Is there a way to monitor number of attempted Skype connections on a specified port and dynamically firewall off the offending IPs if they break a certain threshhold within a specific time limit - in ...
- 39.7k
0
votes
4
answers
4k
views
apache being flooded?
I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
CommunityBot
- 1
1
vote
4
answers
2k
views
Identifying DOS attack [duplicate]
I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
- 375
1
vote
2
answers
14k
views
Blocking UDP packets with a length of 4
My server is being flooded with UDP packets with a length of 4 (header is 32 bytes).
04:56:26.844797 IP 108.241.236.114.47034 > 185.5.173.249.14522: UDP, length 4
04:56:26.844831 IP 5.2.81.91....
- 27.6k
2
votes
2
answers
3k
views
HTTP attack - Too many connections & TIME_WAIT
I am running CentOS 6 with http -2.2.15
Going under HTTP attack, i can see many http process running.
> netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
> 1 established)
> ...
- 26.8k
0
votes
2
answers
4k
views
Defensing againt DDoS attack on Squid server [duplicate]
My Squid (3.1.20 on Ubuntu 13.04) is under DDoS attack (with about 1000 different IPs).
I'm using Basic Authentication on it and all of those requests are getting DENIED response but still they ...
- 19.7k
0
votes
2
answers
1k
views
Is My Website Under DDOS Attack? [closed]
Recently I noticed that the CPU load of my server is increasing rapidly. In any day, the CPU load does not reach 2.5. I have the following server:
Intel® Xeon® E3-1270 v2 Single Processor - Quad Core ...
- 403
3
votes
2
answers
302
views
What amount of effort and money should one invest against DDoS threats? [closed]
Typically, when you invest money to protect yourself against some possible threat, you should take into account two factors:
the probability (p) of the problem actually happening
how much money (m) ...
- 4,005
2
votes
1
answer
515
views
How to protect from DDOS attack that is coming from an exit node
Newroz Telecom (an ISP) is using an exit node (or gateway) for each city they operate in. That is all the users in city A is sharing one public IP (when the users go to a website to show their IP they ...
- 6,691
1
vote
4
answers
1k
views
Solution for DDOS [duplicate]
My server is under DDoS attacks. I see my access log and get something:
968966 93-97-53-41.zone5.bethere.co.uk - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" "Mozilla/...
CommunityBot
- 1
2
votes
1
answer
303
views
Received Notification of my server be involved in "DNS amplification attack". How can I stop? [duplicate]
I just received an email from my website internet provider that my server has been "involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks."
Here is the full email:
...
- 142k
1
vote
2
answers
7k
views
httpd high cpu usage slowing down server response [duplicate]
my client has a image sharing website with about 100.000 visitor per day
it has been slowed down considerably since this morning when i checked processes i've notice high cpu usage from http ....
...
- 187
0
votes
4
answers
107
views
How to identify which website on my instance is receiving lots of traffic?
I am new to server administration and have just setup a new quad core instance which hosts around 15 websites.
Over the past couple of days my server load has been averaging at around 15.00. I ...
- 1,285
0
votes
1
answer
101
views
DDoS attacks are killing all my services [duplicate]
I've a few servers running as ssh proxy, someone started to DDOS me, i've installed ddos deflate and apf. The traffic made by ddos downgrade from 10 MB/s to 1 MB/s but it still make my users kick from ...
- 15.1k
2
votes
4
answers
6k
views
How can I stop a currently active DDoS attack? [duplicate]
My VPS is under a DDoS attack. I cannot access RDP, and I cannot take it offline, or access it in any way at all. What can I do?
They are not trying to bruteforce, just trying to stop access to the ...
- 69.1k
1
vote
1
answer
2k
views
Debian iptables, netstate. DDOS? [duplicate]
My server has been timing out and crashing lately.
I ran this command:
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
Check the picture for result. Does ...
- 25.3k
0
votes
1
answer
9k
views
ICMP time exceeded in-transit
In the last few days my server suffers an attack of this kind:
(bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs)
tcpdump -n proto ICMP
17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
- 25.3k
1
vote
1
answer
288
views
Website slowed down, possible DDOS attack
I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
- 25.3k
1
vote
1
answer
4k
views
IPTables : prevent UDP Flooding
I want to stop the UDP flooding on the Linux device.
I have written a simple IPTable rule to drop all UDP packets
iptables -A INPUT -p udp DROP
But still the DoS attack happens and the device gets ...
- 3,632
1
vote
1
answer
1k
views
can I filter TCP SYN packets with seq=0
My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs.
Packets look like this:
IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0
with ...
- 6,290
0
votes
3
answers
2k
views
Can you block an ip with multiple connections? (Apache ddos attack)
My server is under a Apache ddos attack right now. There's a ton of single ip addresses with 30+ connections.
When I use this SSH command:
netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk -F':...
CommunityBot
- 1
-1
votes
1
answer
950
views
Can the netstat command show what specific website a user is on? [closed]
I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I ...
- 134k
2
votes
1
answer
867
views
Drop compulsive http requests same url, same IP in Apache tomcat
I want to drop http request done to the same url from the same ip inside the same second. That means, its a guy violently pressing F5 or a bot screwing up my server.
Do anyone knows any lib for java ...
CommunityBot
- 1
-1
votes
2
answers
649
views
Router DDoS Protection by MAC [duplicate]
I was wondering if there are any DDoS defences where a (any) router will block all packets (for any period of time) from the MAC address of its attacker. If so, under what circumstances would this ...
CommunityBot
- 1
2
votes
0
answers
90
views
How to prevent HTTP-based DDoS attacks [duplicate]
This night, I've noticed nginx was not responding to requests. After some investigation, I found that it was using 100% of the CPU and error.log was full of messages like this one:
2013/05/28 00:11:...
- 2,298
0
votes
1
answer
93
views
Send mails from secondary server
Problem:
When I send an email from my server, the email headers contain the IP address of the server.
Yeah, this is a problem, because the server is being the target of DDoS attacks. Using CloudFlare ...
- 25.3k
3
votes
1
answer
3k
views
Nginx - Redirect request by GET parameters pattern
One of my servers was attacked by DDoS a couple of days ago and it lasted for 4 days. Below are the logs snippet of the request:
36.224.180.253 - - [14/May/2013:03:11:46 +0800] "GET //?f5b2fd2f860dc=...
- 1,216
0
votes
1
answer
2k
views
Ubuntu Server DDoS protection [duplicate]
I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
- 15.1k
3
votes
1
answer
307
views
Traffic backlogged after (D)DoS attack? [closed]
About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down.
I raced over to my server room, where my TP-Link router was completely unresponsive (...
- 246
4
votes
1
answer
36k
views
How to configure mod_reqtimeout in Apache2
I need to configure mod_reqtimeout in my Apache server v2.2.22 (in a linux machine). Problem is, I have absolutely no clue on how to do it.
I checked the Apache site on this module at this link but ...
- 5,914
0
votes
1
answer
563
views
How to block an IP, if it is making many http/apache/mysql requests in a second?
If some one tried force burst attack on my website, how can i block their IP address?
I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
- 244
0
votes
1
answer
2k
views
Anti-DDos Apache2 Fail2ban regex rule [duplicate]
I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong.
Request which i like to ban look like this:
186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
- 9,739
1
vote
1
answer
1k
views
Parse Apache logfile and ban IPs
My server is under attack, it is flooded with request with the following pattern:
Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
- 9,739
-1
votes
1
answer
2k
views
Any way to Improve performance of iptables DDOS whitelist? [closed]
I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
CommunityBot
- 1
0
votes
2
answers
3k
views
How to properly drop ICMP type 3 packets on possible DDoS attack?
Even after running
iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP
I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:
19:41:31.923630 IP ...
- 5,436
23
votes
9
answers
73k
views
Server under DDOS attack - How to find out IPs?
My server is under DDOS attacks and I want to block the IP that is doing it, what logs should I be looking for to determine the attacker's IP?
- 18.4k