A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
24 views

My VPS send an outbound attack

My VPS was sending an large outbound attack 10MB/s. It's normal max 300Kb/s I've tried searching around the internet, look for some /tmp folder, installed Linux Malware Detect, installed csf with ...
-2
votes
0answers
22 views

Digital Ocean droplets get locked down because of outgoing DDOS attacts [duplicate]

Two of my droplets were locked down this week from my account for an apparent reason of outgoing DDOS attack. My first machine was allegedly compromised on Nov 18 2014 and my networking is brought ...
-3
votes
0answers
19 views

attack to vps trought requests from localhost [on hold]

I'm having a problem with a vps running ubuntu 12that i own. Last days, the cpu of the vps was at 100% all the time. Running htop, i was able to see that i have a process named "host", created by ...
0
votes
0answers
28 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
-1
votes
1answer
39 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
22
votes
6answers
23k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
0
votes
1answer
35 views

GRE Tunnel in CentOS

How to create a GRE Tunnel in CentOS pointing all connections to server A for the server B? I have a public server with DDoS protection and need to use this as a firewall to filter acess to the other ...
0
votes
2answers
35 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
0answers
32 views

Configure Router for better DDoS protection Actiontec MI424WR [migrated]

So for the past month, my server has been attacked by script-kiddies three times. The server is mainly used as a minecraft server. I am getting worried that this is becoming an outbreak as many of ...
1
vote
2answers
133 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
0
votes
1answer
54 views

Can I block inbound traffic from a certain ISP

The problem My server keeps getting DDoS attacks from IP's belonging to Ecatel in The Netherlands. I wrote them a month ago and still haven't heard anything, and keep blocking individual IP addresses ...
0
votes
2answers
2k views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
1
vote
1answer
258 views

DDoS attack simulation using MININET

I´m developing some dynamic security policies using SDN, one of them consist in how the network should respond to a DDoS attack detection. So, I would like to test my policies but I'm having some ...
0
votes
0answers
204 views

Apache Server 2.4 on EC2 “caught SIGTERM shutting down ”

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down: [Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] ...
4
votes
6answers
4k views

Tools for simulating DDoS attacks

I wanted to test my website if it can sustain strong DDoS's, but I don't know which tools could I use to simulate them in my website. What tools are used to simulate DDoS? I found bonesi but it was ...
0
votes
0answers
31 views

Recommended values for DIPR configuration on a web-server

Microsoft has this great module for IIS server: The Dynamic IP Restrictions (DIPR) module for IIS 7.0 and above provides protection against denial of service and brute force attacks on web ...
3
votes
4answers
3k views

Protecting Hosted Windows 2008 Servers against DDOS Attacks

Followup to Identifying DDOS Attacks on Windows 2008 Servers. What steps are people taking to prevent DDOS attacks against their Windows 2008 Servers in a hosted environment? I'm particularly ...
-1
votes
2answers
145 views

Block incoming traffic from unresolved IP address

How can I block all the incoming traffic from unresolved IP addresses? I am using CentOS with WHM/cPanel installed. I am getting huge junk traffic and 95% is from unresolved IP addresses and only 5% ...
0
votes
1answer
43 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
3
votes
2answers
750 views

Protecting against Keep-Dead Denial of service

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash. I've looked through the logs but can't see ...
1
vote
3answers
386 views

My webserver is getting flooded with invalid requests

My webserver (nginx) keeps getting requests like this: 23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET ...
1
vote
1answer
59 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
0
votes
2answers
324 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
0
votes
1answer
67 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
2
votes
1answer
470 views

Outlook for Mac, Active Directory DNS and DDOS

Edit: This is not a question about DDOS, but a question about how to resolve a technical issue impacting only Mac clients of Outlook Anywhere. Problem and solution are are now known, but I cannot ...
0
votes
1answer
66 views

Lots of connections to loopback, could be slowing us down

I'm trying to debug a sudden increase in our load average. I looked at this page to see if we were being DDoS'ed but the standout IP address was the loopback address: $ netstat -ntu | awk '{print ...
0
votes
0answers
82 views

Is it DDOS attack?

For three successive days, now, I'm having four or five unique servers' queries being denied by my csf firewall, which are renamed in the following extract I got from my log as "www.example1.com", ...
3
votes
4answers
3k views

EC2 ELB and DOS attacks

I'm using Amazon's ELB to load balance between servers, When my site is under attack by bots, everything is exhausted, so here is the problem I can't block IP addresses with Amazon's security ...
0
votes
1answer
245 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
0
votes
1answer
295 views

.htaccess rules to stop DDoS POST flooding

We're under a distributed denial of service attack from traffic that looks like this: 49.146.161.175 - - [11/Jul/2014:00:43:42 -0400] "POST / HTTP/1.1" 500 557 "-" "Mozilla/4.0 (compatible; MSIE 6.0; ...
1
vote
2answers
123 views

blocking udp attack ip with iptables

I was trying to block an ip of ( network stresser tool - a ddos websites selling ddos bots by seconds online ) the first one i was trying to block with iptables : iptables -A INPUT -d 173.193.26.73 ...
1
vote
2answers
109 views

Does CloudFlare make a site a greater potential DDOS target?

CloudFlare has gotten a lot of press recently as protecting businesses from DDOS attacks. But from looking at their twitter feed, it looks like they are targeted every day, and large segments of their ...
1
vote
2answers
60 views

How to find the count of Apache workers' at a given point for shared IPs?

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing: netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc ...
88
votes
1answer
5k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
0
votes
0answers
101 views

How do you protect your <appid>.appspot.com domain from DDOS attack?

If I want to use CloudFlare to help protect my GAE app via it's custom domain, I still am vulnerable to attacks directly on the .appspot.com domain. How do I mitigate that? I could force redirect ...
8
votes
7answers
7k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
1
vote
1answer
895 views

Amazon EC2 abuse [duplicate]

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
0
votes
1answer
270 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
-2
votes
2answers
136 views

Is it possible to prevent DDoS attacks? [closed]

I recently read that certain industries—including the one I work in—are more likely than others to be targeted by a DDoS attack. Can you give me some tips on how to prevent DDoS attacks?
0
votes
1answer
657 views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
2
votes
4answers
2k views

Mitigating an http flood? [duplicate]

I have a ddos protection proxy in place to deal with SYN floods and such. But http floods are still getting through. For some reason their ddos proxy is not blocking any of the flood. So there are ...
2
votes
1answer
385 views

SynFlood attack, spoofed IPs, syncookies mitigation

Due to a recent increase in SynFlood attacks on my company's systems i've been testing by Syn flooding the hosts myself to see how easy they are to disrupt, and the answer is 'quite easy'. By using a ...
5
votes
3answers
2k views

DDOS using ntp server

I've heard about new kind of DDOS where ntp is used for reflection . My questions are really simple : Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose ...
1
vote
0answers
257 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
493 views

High outbound network traffic on Tomcat under process nodeJR

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...
1
vote
0answers
46 views

Multiple DDOS protection interfaces merging on one TS server

The problem I have is I have 3 DDOS protection interfaces from a multi homed DDOS protection solution and teamspeak is refusing to return packets via the correct interface (aka the one that sent it ...
0
votes
0answers
226 views

Apache2 php-cgi processes, how to limit them?

I have a 32gig ram dedicated server running on Ubuntu 12.04 with ISPConfig / Apache configuration. The thing is, anyone can take the site down simply by holding down F5 button for 20 seconds causing ...
2
votes
1answer
341 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
0
votes
1answer
616 views

Apache logs flooded with connections - “(via ggpht.com GoogleImageProxy)”

My server was running on 100% CPU and looking at the Apache logs I saw hundreds of thousands of connections that looked like this: 10.190.45.31 - - [13/Mar/2014:15:29:02 +0000] "GET SOMETHING ...
4
votes
3answers
559 views

Can't stop DDOS [duplicate]

I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it. (1gbs is the maximum speed of the server.) I've the following iptables rules: ...