A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
18 views

(D)DoS Detection within linux and IPTables

We currently have a hardware firewall running on Ubuntu 14.04 on a 10Ge network. We use this to filter traffic and attacks, this is all working great and we have blocked quite a lot of DNS/NTP attacks....
-2
votes
0answers
23 views

Server starts DDoSing out of nowhere [duplicate]

I've started renting a VPS and have been using it a few weeks back. I am however, not very familiar with managing it. I just checked my e-mail and found that my VPS has started DDoSing. The company ...
0
votes
1answer
30 views

Possible DDoS (not sure). Cannot trace with netstat

I have a KVM node I'm running with only 7 VM instances. When GigE uplink port is enabled, server connection goes crazy hitting over 300MBps somehow. I cannot trace which IP is possibly being attacked, ...
0
votes
0answers
5 views

Am I under a DDoS attack? [migrated]

OK, so here's some info: Fedora23 running in VirtualBox on a Windows 7 Host. Public-facing router has no DMZ, but port forwarding from 2325 (external) to 1194 (internal) and the internal static IP. ...
-1
votes
2answers
48 views

How to count the number of SYN, ACK, or SYN-ACK in a second? [closed]

I want to make a DDoS SYN Flood Detection, so i need to count the number of SYN, ACK, or SYN-ACK packet per second.
2
votes
5answers
1k views

Does a VPS mitigate risks of a DDOS attack versus shared hosting?

A client of mine has a website on a shared hosting account, and one of the other accounts on that server was targeted by a DDOS attack, which of course brought all of the websites on that server down. ...
0
votes
2answers
83 views

How do black holes mitigate ddos attacks?

I'm looking at how to try and prevent DDOS attacks before I launch a website as I will expect lots of online 'booters' to attack the server. I've read through lots of threads on here and ...
0
votes
1answer
65 views

Attempting to block “wordpress” useragent is overloading CPU [duplicate]

I've had some DDoS issues - specifically the XML-RPC exploit (wordpress) wherein thousands on thousands of Wordpress instances attack my machine. I have the following in my nginx server block: ...
13
votes
3answers
604 views

Dealing with NTP reflection attacks in IPTables

We're dealing with an NTP reflection / amplification attack at our colocated servers. This question is specific to responding to NTP reflection attacks, and not directed at DDoS in general. Here's ...
-1
votes
1answer
37 views

Run shell script on the event of “possible SYN flooding”

Since it doesn't appear to be possible to get "netstat" stats at the time I got an SYN flooding, I'd like to write a script that gets all the stats I need (top IPs, used memory, etc) and write to a ...
0
votes
1answer
46 views

Handle “possible SYN flooding on port 443. Sending cookies.”

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast. However, the server appears to ...
0
votes
0answers
22 views

DDos attack on port 80 and limiting connection does not work [duplicate]

I have a Centos server running apache 2.4 and someone keeps connecting to the server causing http requests to timeout. I have searched the internet for answers to solve this problem and someone asked ...
-4
votes
2answers
50 views

Does it make sense to have a server dedicated to login? [closed]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
37
votes
6answers
46k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
0
votes
0answers
13 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
1
vote
1answer
40 views

CentOS 7 machine lost connectivity after DDoS attack [closed]

We were testing the DDoS protection of a CentOS 7 machine but after it ended, the connection on the machine is just gone. The configuration of the connection is exactly identical to before the DDoS ...
0
votes
0answers
35 views

Alghough TCP SYN Backlog size is set to 128 but in practical it is limited to 16

as you know in ubuntu, tcp syn backlog size is 128 by default. i tried to syn flood my ubuntu linux by hping3. to do that, i send 100 spoofed tcp syn packets per second to the ubuntu and meanwhile i ...
0
votes
1answer
31 views

Establishing TCP Connections by hping3

when a client sends 10 TCP SYN packets by hping3(not spoofing), server responds and sends 10 TCP SYN+ACK packets. now client should answer to server and Establish the connection by sending 10 ACK ...
0
votes
2answers
54 views

DDOS Attack without Matching Virtual Hosts

I'm getting very weird kind of DDOS attacks, the server is flooded with requests however the problem is, when going through the access log, is im getting different requests to non-existent domains and ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
9
votes
2answers
1k views

Is it possible to have a secondary managed DNS provider to quickly delegate to when DDOS attack on our *primary* external DNS provider happens?

So our DNS provider, every so often, experiences DDOS attacks on their systems that causes our front-facing web sites to go down. What are some options in terms of reducing dependency on a SINGLE ...
-1
votes
1answer
34 views

How can I only allow TCP connections for 1 port using iptables on Unbantu? How can I also set a maximum packet on a connection?

I'm running a server for public. I just want to allow TCP connections and I want to limit the packet to prevent ddosing a bit and setting a maximum IP/new connections per seconds with iptables. How ...
0
votes
1answer
27 views

Solid way to set up DDoS protection for a SaaS with many customer domains

I will be launching a SaaS soon. Customers will be able to sign up and get their own 'space'. Each customer will get a generated sub domain plus they can add their own custom domain if they wish too. ...
0
votes
1answer
654 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
0answers
30 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
1answer
68 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
0
votes
2answers
100 views

I'm trying to stress test a site but no hosting company will let me. What can I do?

We need to know what to expect if a rogue actor DDOSes one of our production sites, so I'm looking to spin up a few VPSes with web apps on so that I can simulate a DDOS against them with an online ...
-1
votes
2answers
38 views

Fallback between datacenters

What is the best way to do a fallback between datacenters. We have a dedicated server in one of the data centers and as our traffic increased i wanted to add more then backup i wanted redundancy and ...
1
vote
0answers
52 views

Using a VPS as front end proxy

I run a shell host that many users share which gets frequently DDoS'd (at least once every other month). So I have come up with a plan to peer all traffic with a VPS, so that it appears to everyone ...
0
votes
0answers
12 views

Ofbiz Ubuntu Server Vulnerability [duplicate]

My EC2 Instance is running ubuntu 14.04 and apache ofbiz-14.02. I found a python file was uploaded to server in ofbiz installation folder which I highly suspect it is the fraud by ofbiz which allowed ...
1
vote
0answers
45 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
36 views

nginx stub status SPIKES “writing” for a few seconds, causing 504 error. Why?! Bad VPS neighbour?

I am using Apache and nginx as reverse proxy, with php5-fpm. The latest week we've been receiving the following error in nginx's error.log: upstream timed out (110 connection timed out) while reading ...
-2
votes
1answer
136 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
0
votes
0answers
116 views

nginx req limit & fail2ban & cloudflare large attacks

I started to use as the topic says nginx with req limit + fail2ban + cloudflare. If someone exceeds the requests on any php file the ip gets blocked over the cloudflare api in the "ip firewall" on ...
0
votes
0answers
18 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
1
vote
2answers
18 views

Quantifying site response in case of DOS/DDOS attack tests

Let us say that we need to test a HTTPS web site for vulnerability/response in case of DOS/DDOS attacks. Among other tools, we can use GoldenEye for this purpose. We can vary the number of workers ...
1
vote
2answers
2k views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-4
votes
2answers
132 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
2
votes
1answer
519 views

many graceful restarts in httpd error log?

Our server was down , and we restatred the services (nginx & httpd), and when i look at the logs, i've found these lines , there are so many Graceful restart requested, doing restart lines, whats ...
136
votes
3answers
12k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
0
votes
1answer
20 views

Preventing IP address from hitting Apache Tomcat by configuring Apache

We got Tomcat that needs to be restarted quite often on our production. Examining Apache access log file, I can see that certain IP addresses are hitting same logon page hundreds of times one after ...
0
votes
3answers
290 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk '{...
0
votes
1answer
37 views

how to block access for RSS Feed using htaccess

My website is experiencing RSS Feed problem I get this htaccess code Order deny,allow Deny from all Allow from xx.xx.xx.xx but it blocks all IP address i just need to block mywebsite.com/feed.php ...
-2
votes
1answer
65 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
103 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
1
vote
1answer
251 views

DDOS mitigation of GCE

I am hoping to start shared hosting service on Google Compute Engine. Does the Google infrastructure have any DDOS mitigation built-in? This article here says it does. "Compute Engine makes use of ...
0
votes
0answers
12 views

Digital Ocean locked my droplet saying it was compromised and participating in ddos. How can I look into this? [duplicate]

I have a digital ocean droplet and I got a support ticket sent to me saying they've had to lock my droplet because it was flooding their network, assuming it has been compromised and performing ddos ...
0
votes
0answers
42 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
1
vote
2answers
711 views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: http:/...
0
votes
1answer
64 views

Wrodpress DDOS /xmlrpc.php

This is what my nginx access.log looks like as I write this times infinity: 127.0.0.1 - - [19/Jan/2016:00:59:36 -0500] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; ...