A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

-1
votes
1answer
26 views

How can I only allow TCP connections for 1 port using iptables on Unbantu? How can I also set a maximum packet on a connection?

I'm running a server for public. I just want to allow TCP connections and I want to limit the packet to prevent ddosing a bit and setting a maximum IP/new connections per seconds with iptables. How ...
0
votes
1answer
16 views

Solid way to set up DDoS protection for a SaaS with many customer domains

I will be launching a SaaS soon. Customers will be able to sign up and get their own 'space'. Each customer will get a generated sub domain plus they can add their own custom domain if they wish too. ...
0
votes
1answer
615 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
0answers
24 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
1answer
57 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
-2
votes
0answers
23 views

Protect my Strato VPS (Windows 2012) to be used in a ddos attack [duplicate]

According to Strato, my VPS (Windows 2012 server) was used (abused) in a DoS attack and is taken offline because of this. Unfortunately my knowledge about how to prevent this from happening again ...
0
votes
2answers
76 views

I'm trying to stress test a site but no hosting company will let me. What can I do?

We need to know what to expect if a rogue actor DDOSes one of our production sites, so I'm looking to spin up a few VPSes with web apps on so that I can simulate a DDOS against them with an online ...
-1
votes
2answers
34 views

Fallback between datacenters

What is the best way to do a fallback between datacenters. We have a dedicated server in one of the data centers and as our traffic increased i wanted to add more then backup i wanted redundancy and ...
1
vote
0answers
35 views

Using a VPS as front end proxy

I run a shell host that many users share which gets frequently DDoS'd (at least once every other month). So I have come up with a plan to peer all traffic with a VPS, so that it appears to everyone ...
37
votes
6answers
43k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
0
votes
0answers
12 views

Ofbiz Ubuntu Server Vulnerability [duplicate]

My EC2 Instance is running ubuntu 14.04 and apache ofbiz-14.02. I found a python file was uploaded to server in ofbiz installation folder which I highly suspect it is the fraud by ofbiz which allowed ...
-1
votes
0answers
11 views

Get traffic / requests list from AWS console

I started working on a new project and it seems that currently I am under attack. I can see abnormal amount of connections to the DB (500+) and I can't find the source because the project has no ...
1
vote
0answers
33 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
25 views

nginx stub status SPIKES “writing” for a few seconds, causing 504 error. Why?! Bad VPS neighbour?

I am using Apache and nginx as reverse proxy, with php5-fpm. The latest week we've been receiving the following error in nginx's error.log: upstream timed out (110 connection timed out) while reading ...
-2
votes
1answer
85 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
0
votes
0answers
51 views

nginx req limit & fail2ban & cloudflare large attacks

I started to use as the topic says nginx with req limit + fail2ban + cloudflare. If someone exceeds the requests on any php file the ip gets blocked over the cloudflare api in the "ip firewall" on ...
0
votes
0answers
17 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
1
vote
2answers
18 views

Quantifying site response in case of DOS/DDOS attack tests

Let us say that we need to test a HTTPS web site for vulnerability/response in case of DOS/DDOS attacks. Among other tools, we can use GoldenEye for this purpose. We can vary the number of workers ...
1
vote
2answers
2k views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-4
votes
2answers
86 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
2
votes
1answer
323 views

many graceful restarts in httpd error log?

Our server was down , and we restatred the services (nginx & httpd), and when i look at the logs, i've found these lines , there are so many Graceful restart requested, doing restart lines, whats ...
132
votes
4answers
11k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
0
votes
1answer
20 views

Preventing IP address from hitting Apache Tomcat by configuring Apache

We got Tomcat that needs to be restarted quite often on our production. Examining Apache access log file, I can see that certain IP addresses are hitting same logon page hundreds of times one after ...
0
votes
3answers
257 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
0
votes
1answer
29 views

how to block access for RSS Feed using htaccess

My website is experiencing RSS Feed problem I get this htaccess code Order deny,allow Deny from all Allow from xx.xx.xx.xx but it blocks all IP address i just need to block mywebsite.com/feed.php ...
-2
votes
1answer
62 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
75 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
1
vote
1answer
102 views

DDOS mitigation of GCE

I am hoping to start shared hosting service on Google Compute Engine. Does the Google infrastructure have any DDOS mitigation built-in? This article here says it does. "Compute Engine makes use of ...
0
votes
0answers
12 views

Digital Ocean locked my droplet saying it was compromised and participating in ddos. How can I look into this? [duplicate]

I have a digital ocean droplet and I got a support ticket sent to me saying they've had to lock my droplet because it was flooding their network, assuming it has been compromised and performing ddos ...
0
votes
0answers
41 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
1
vote
2answers
506 views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: ...
0
votes
1answer
55 views

Wrodpress DDOS /xmlrpc.php

This is what my nginx access.log looks like as I write this times infinity: 127.0.0.1 - - [19/Jan/2016:00:59:36 -0500] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; ...
0
votes
1answer
176 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
2
votes
3answers
91 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. ...
2
votes
4answers
2k views

Can a DDoS attack stop me from SSH’ing into my server?

Can a DDoS attack stop me from ssh'ing into my server? My boss says no, therefore it must be something wrong with the server. However we are getting botted by 4-5 different bots even with robots.txt ...
0
votes
0answers
27 views

Clinet-side solutions to prevent DNS amplification without rate limiting on an open DNS server? [duplicate]

Are there alternative ways to operate an open/forwarding DNS server, without having to use rate limiting or other means of traffic inspection to prevent being used for DNS amplification attacks? ...
-1
votes
1answer
53 views

DDos attack ToS Violation - Outbound DoS [duplicate]

Fount ddos attack on ubuntu server netstat -nputw given outout Local Address Foreign Address State PID/Program name 55.57.72.37:59792 123.166.137.95:25000 SYN_SENT ...
-1
votes
2answers
66 views

AWS DNS DDoS mitigation

I have an AWS server that is currently under DDoS via DNS amplification. I've setup CloudWatch logs for the VPC ACL and it's logging an enormous amount of rejected DNS traffic. Despite that traffic ...
0
votes
1answer
226 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
0
votes
0answers
31 views

How to monitor AWS EC2 instance in order to recognise DDOS and identify bottlenecks? [duplicate]

I have web app (NodeJs) running on AWS EC2 Ubuntu instance. I would like to monitor it somehow so I would be able to quickly recognise DDOS attacks. I would also like to identify bottlenecks etc. What ...
1
vote
2answers
104 views

Protecting private IP address using Google for Work's SMTP settings

We currently got a website that is protected with cloudflare, however there is one leak we found. Our server's IP is shown in email headers, which makes cloudflare kinda useless at this point. We've ...
2
votes
1answer
1k views

Mitigate DDoS attack by Null-routing my server's IP?

My services were attacked by what appears to be a botnet of quite a large number of computers. Since all my servers have additional IPs, and my hosting provider lets me null-route my IP addresses to ...
0
votes
0answers
105 views

I can DDOS my server with one client by doing ctrl+F5

First of all I really don't know where I should start my investigation. I'll post the configuration files as soon as you'll ask. The server is windows 2008 R2 with Apache 2.4.9 and PHP 5.6. on a VM, ...
0
votes
0answers
47 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
0answers
45 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
10
votes
7answers
11k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
0
votes
0answers
40 views

nginx deny POST requests to the index route

i recently noticed DDos-like attacks on my server and now i'm in charge of trying to reduce the damage they deal. They aren't that heavy, but it's enough for the poor performance my server delivers. ...
0
votes
0answers
16 views

Massive DDoS hitting my VPS, no idea what to do [duplicate]

for the past few days there has been a massive amount of connections hitting my VPS. I am not sure whether my VPS is actually being attacked or just being used for DDoSing someone else's server. ...
1
vote
1answer
308 views

Exim SMTP reverse proxy [closed]

This is my first post on Serverfault, so if I make some mistakes, please let me know. The issue that I'm dealing with right now is a DDoS attack on my Exim mailserver (cPanel) on port 25. From what I ...
0
votes
1answer
50 views

How do black holes mitigate ddos attacks?

I'm looking at how to try and prevent DDOS attacks before I launch a website as I will expect lots of online 'booters' to attack the server. I've read through lots of threads on here and ...