A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

1
vote
2answers
247 views

Deny all “direct” traffic [duplicate]

My server is under heavy attack (maybe DDOS, I've no idea). I've checked the access logs (to put things into perspective, it's site with a daily 1000 visitors, nothing fancy): 78.176.175.208 - - ...
-1
votes
1answer
31 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
15 views

Forwarding Ports? [on hold]

Is it possible to turn a server into a full proxy tunnel regardless of protocol? Like, say I have server A which has DDoS protection and server B that doesn't. Only thing is server B has higher ...
4
votes
2answers
9k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
0answers
23 views

Filtering KVM guests with IPtables

My partner has a server with OVH that receives a constant variety of ddos attacks, while still staying up. We want to use IPtables on the host to filter the guests VM's traffic. The guest VM we want ...
-1
votes
0answers
32 views

How do I visually analyze/check DDOS attacks? [closed]

How do I tell that a DDOS attack is happening on my servers? Is there a tool which provides visual cues to figure out what is happening or which IP is causing trouble, which IP to block. A simple ...
-1
votes
1answer
44 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
1
vote
2answers
106 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...
0
votes
3answers
2k views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
-5
votes
0answers
31 views

Block All Connections Not From CloudFlare [duplicate]

I have a simple request. I would like to only allow traffic to my server from cloudflare. My website is being pounded by attacks, and there is no legit reason someone should be making a connection to ...
-1
votes
0answers
27 views

How to stop SYN RECV Flood?

I currently am under SYN_Flood (see picture) and I simply do not know how I can protect me from . I already SYN cookies enabled on the server . What can I do else? Because of that attack my server ...
3
votes
3answers
2k views

Apache getting hammered by nonsense requests, how to stop?

My VPS is getting hammered with attempts on random files/directories that don't exist on my server, in the order of roughly twice every second. Presumably it's just a bot trying to figure out whether ...
2
votes
0answers
62 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
2
votes
0answers
24 views

How to enable SYN Cookies on Debian 7.5? [migrated]

How do I enable SYN Cookies on Debian 7.5? nano /etc/sysctl.conf #net.ipv4.tcp_syncookies = 1 remove here the # sysctl -p service network restart Is that the correct way? Or what must I look ...
1
vote
1answer
56 views

IPTABLES block User-Agent

I get DDoS by the Wordpress Pingback BOTNET, now I want to block all client who contain Wordpress in there Useragents. For example: WordPress/4.0; http://vk.lokos.net; verifying pingback from ...
0
votes
0answers
55 views

Make NGINX Block All Requests To Direct Server IP - Stop XML-RPC Attacks

Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help. Any assistance would be greatly appreciated :)! ...
0
votes
1answer
931 views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
0
votes
1answer
52 views

DOS and DDOS attacks [closed]

Our website is being constantly attacked by the bots. We tried mod_evasive and mode_security but those modules slowed our server considerably. Can anybody please suggest more solutions. Thanks in ...
2
votes
0answers
32 views

Getting DDoSed with requests for links to other sites and Bittorrent and BingBar [duplicate]

The other day my server started getting slow and the logs showed it was being heavily spammed with strange requests like for BingBar, 218.94.73.210 - - [22/Apr/2015:13:25:37 +1200] "GET ...
0
votes
1answer
20 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
9
votes
6answers
671 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
2
votes
4answers
2k views

Where to find and how to block blacklisted IPs and proxies?

Good day everyone! I'm looking for a way to block incoming requests from blacklisted IPs and proxies (mostly anonymous) to my server. While it's quite obvious how to do it using Apache config the ...
1
vote
0answers
51 views

Kernel panic under DDOS

I'm running a Debian 6 - 64bit system (Kernel 2.6.32-5-amd64) and often get flooded with DDOS. I have tuned the network parameters under /etc/sysctl.conf to not let any kernel parameter overflow. ...
-1
votes
2answers
49 views

IPTables not blocking IPStresser [closed]

I have been trying four days to block DDoS attacks with no success. I want to block anything that isn't whitelisted. This is my idea on OS Centos 7: //Delete All Existing Rules iptables --flush ...
1
vote
1answer
33 views

what would be the Impact of using Multiple sites in same VPC on AWS platform?

I have a site running on four server inside of a VPC on aws platform. My question is would their be any impact on site if I host another website on four new server in the same VPC considering their ...
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
1answer
49 views

How to block ApacheBench from sending requests to server?

I'm using Ubuntu 14.10, Apache 2.4. My server is under a huge DDoS attack right now, I tried to use mod_security , fail2ban and blocking attacking IPs manually using iptables and nothing worked. The ...
0
votes
1answer
69 views

How to defense a DDoS powered by end user's browser?

Like what Github.com has just experienced, what if a script provider, such as google ads, google analysis or something similar, add a malicious scripts at the end of their script, and let end users ...
0
votes
3answers
82 views

What is the most effective way to block IP address in Application Layer?

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
0
votes
0answers
32 views

“eth0: link up” kernel panick on debian - DDoS attack or soft / device issue

A few hours ago my dedicated machine in Hetzner went down. I was thinking what that was DDoS attack, or Hetzner network problem. But my other machine was working fine. So i loggined into Hetzner and ...
0
votes
2answers
45 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
1answer
141 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
1
vote
1answer
47 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
0
votes
0answers
33 views

How can node addition/substraction be done while keeping randomness in their connections in a P2P unstructured network?

If a unstructured P2P network that uses an admission mechanism for new peers entrance gets completely offline because of a massive attack (e.g. massive DDoS), after reconnecting, peers will try to ...
5
votes
2answers
154 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
3
votes
7answers
649 views

DDOS Attack Victim - How much to Admit?

Here's the environment: Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so Many Clients pay to use the site ...
2
votes
2answers
227 views

Monitor DoS attack with snmp [closed]

Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?
0
votes
1answer
3k views

Iptables ratelimit UDP DOS attacks [duplicate]

Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way, Attackers are ...
0
votes
2answers
593 views

Prevent scanning of the Apache's /default directory [duplicate]

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is ...
0
votes
1answer
1k views

Best Practice for captcha based protection against D.O.S to Nginx Proxy [duplicate]

The idea is explained here In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers. If the number of request times within a certain period from ...
2
votes
1answer
172 views

How can I implement an ip whitelist to protect my server? [duplicate]

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
4
votes
1answer
233 views

Windows server 2008, a very small DDoS is able to kill my server [duplicate]

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
-3
votes
1answer
203 views

Is this DoS attack [duplicate]

I am seeing a huge number of connections from a single IP. # netstat -alpn | grep :80 | grep 92.98.64.103 tcp 0 0 my.ip.address.x:80 92.98.64.103:45629 TIME_WAIT - ...
0
votes
1answer
225 views

iptables connection limit does not work on debian [duplicate]

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
0
votes
2answers
318 views

netfilter ip_conntrack and (d)DoS [duplicate]

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
1
vote
2answers
342 views

PHP web hosting: how to prevent clients to DOS/DDOS? [duplicate]

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts. Besides the security routine I'll have to check (off topic here) I would like to know ...
-1
votes
1answer
416 views

TCP DOS: How to terminate CLOSE_WAIT connections? [duplicate]

One of my servers is getting DOS'ed - there are a large number of connections in the CLOSE_WAIT state which are preventing legitimate users from connecting to the system. So is there any way to close ...
4
votes
2answers
104 views

Will MX records with a longer TTL help mitigate effects of DoS attack? [duplicate]

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
1
vote
2answers
302 views

blocking udp attack ip with iptables [duplicate]

I was trying to block an ip of ( network stresser tool - a ddos websites selling ddos bots by seconds online ) the first one i was trying to block with iptables : iptables -A INPUT -d 173.193.26.73 ...
0
votes
1answer
18 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...