A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
0answers
11 views

Block connection through proxy in firewall [duplicate]

I'm getting some 'ddos' on my Linux machine (ubuntu 14.04 64bit). I have a lot of connections from IP which are proxy IP's (like tor), on specific port. Question: How to block all proxy connections ...
1
vote
2answers
43 views

High inbound and outbound network traffic

Over the last day or so, one of instances has had a large amount of bandwidth consumed. This means that we have nearly exceeded our allowance (roughly the same amount inbound and outbound). Looking ...
-2
votes
0answers
13 views

Do websites maintain partial functionality during ddos-like high levels of traffic? [closed]

I asked this on stackexchange but was told to post here. Forgive me for any technical shortcomings I might have, I have some degree of knowledge of computer science but not extensive. So I'm into ...
-3
votes
0answers
30 views

Redirect IP to another IP [on hold]

My domain redirects to my Teamspeak 3 Server on port 9987, and it works perfectly. But now I will add a second server to block DDoS so I must redirect my domain to server #1 and server #1 must ...
-1
votes
1answer
29 views

Linux DDOS Protection / Gateway without NAT

I need help to configure a box for DDOS protection and provide external ip addresses to "internal" (which aren't really internal) servers. I have 32 IP addresses from my ISP. I want to configure a ...
0
votes
0answers
26 views

Use extra firewall to filter WAN traffic before reaching UTM?

I am running a simple web server behind UTM, only port 80,443 is open. However almost 80% of the traffic coming through WAN is trouble. Mostly are port scanners / sniffers or systematically querying ...
0
votes
1answer
44 views

Blocking ddos string with iptables [duplicate]

I want to ask how do block spefic packet payload? 14:46:35.837759 IP 145.92.16.14.27017 > x.27030: UDP, length 25 0x0000: 4500 0035 44a4 0000 ee11 53ae 915c 100e E..5D.....S..\.. ...
1
vote
0answers
67 views

Exim SMTP reverse proxy

This is my first post on Serverfault, so if I make some mistakes, please let me know. The issue that I'm dealing with right now is a DDoS attack on my Exim mailserver (cPanel) on port 25. From what I ...
0
votes
2answers
51 views

How to secure Windows Server 2012 R2 against “open recursive resolver” attack

I received an email from an ISP stating that our server had participated in a DDOS attack against one of their servers--and that we appear to be running an "open recursive resolver". The IP address ...
0
votes
0answers
35 views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: ...
0
votes
1answer
53 views

DDOS prevention/mitigation on Linux CentOs server using IP tables

One of our servers has generated a 19Gb access.log in the space of about 24 hours and the server went down in this time. We'd like to implement some measures to safeguard against DDOS attacks but ...
0
votes
0answers
53 views

mod_evasive can't be installed: “undefined symbol: evasive24_module”

I wanted to protect my Apache/2.4.6 (CentOS) server in CentoOS 7 from DDOS attacks so after searching for some alternatives I found this page. They go through the installation of the modules evasive ...
0
votes
1answer
116 views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
0
votes
0answers
33 views

limit_req on nginx not working

Iam using Ubuntu server 14.04 with apache + nginx proxy over it. I tried to set up limit_req in /etc/nginx-sp/nginx-sp.conf as this: http { limit_req_zone $binary_remote_addr zone=one:1m ...
2
votes
1answer
72 views

Protecting against a DOS attack

Someone is DOSing my server. It is not a DDOS attack as there is only one server involved in this attack. I simply put following iptable rule to drop all the packets coming from the attacker: ...
-1
votes
1answer
124 views

How to stop small DDOS attacks (443 port)?

On the server goes DDoS attack. ~# netstat -n -p | awk '{print $5}'|awk -F: '{print $1}' | sort -n | uniq -c | sort -nr | head -n10 48 109.229.9.53 47 31.207.244.130 45 87.252.227.83 ...
-3
votes
2answers
63 views

block or log IPs that direct access my website (ubuntu , nginx)

The website is under DDOS, the cloud service is doing a pretty good job for a cost of dozen bugs a month. We are happy! However the attackers have been hitting our site with IP. Currently, we 301 ...
1
vote
2answers
257 views

Deny all “direct” traffic [duplicate]

My server is under heavy attack (maybe DDOS, I've no idea). I've checked the access logs (to put things into perspective, it's site with a daily 1000 visitors, nothing fancy): 78.176.175.208 - - ...
-1
votes
1answer
43 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
4
votes
2answers
10k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
0
votes
0answers
39 views

Filtering KVM guests with IPtables

My partner has a server with OVH that receives a constant variety of ddos attacks, while still staying up. We want to use IPtables on the host to filter the guests VM's traffic. The guest VM we want ...
-1
votes
1answer
77 views

Too large 127.0.0.1 connections with nginx - apache2 [duplicate]

I use nginx as proxy-server apache2 and I have a problem with netstat output: $ netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 5 109.195.36.169 6 109.195.33.205 8 ...
1
vote
2answers
139 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...
0
votes
3answers
2k views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
3
votes
3answers
2k views

Apache getting hammered by nonsense requests, how to stop?

My VPS is getting hammered with attempts on random files/directories that don't exist on my server, in the order of roughly twice every second. Presumably it's just a bot trying to figure out whether ...
2
votes
0answers
88 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
1
vote
1answer
243 views

IPTABLES block User-Agent

I get DDoS by the Wordpress Pingback BOTNET, now I want to block all client who contain Wordpress in there Useragents. For example: WordPress/4.0; http://vk.lokos.net; verifying pingback from ...
0
votes
0answers
174 views

Make NGINX Block All Requests To Direct Server IP - Stop XML-RPC Attacks

Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help. Any assistance would be greatly appreciated :)! ...
1
vote
1answer
1k views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
0
votes
1answer
87 views

DOS and DDOS attacks [closed]

Our website is being constantly attacked by the bots. We tried mod_evasive and mode_security but those modules slowed our server considerably. Can anybody please suggest more solutions. Thanks in ...
2
votes
0answers
32 views

Getting DDoSed with requests for links to other sites and Bittorrent and BingBar [duplicate]

The other day my server started getting slow and the logs showed it was being heavily spammed with strange requests like for BingBar, 218.94.73.210 - - [22/Apr/2015:13:25:37 +1200] "GET ...
0
votes
1answer
31 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
9
votes
6answers
684 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
2
votes
4answers
3k views

Where to find and how to block blacklisted IPs and proxies?

Good day everyone! I'm looking for a way to block incoming requests from blacklisted IPs and proxies (mostly anonymous) to my server. While it's quite obvious how to do it using Apache config the ...
1
vote
0answers
63 views

Kernel panic under DDOS

I'm running a Debian 6 - 64bit system (Kernel 2.6.32-5-amd64) and often get flooded with DDOS. I have tuned the network parameters under /etc/sysctl.conf to not let any kernel parameter overflow. ...
-1
votes
2answers
77 views

IPTables not blocking IPStresser [closed]

I have been trying four days to block DDoS attacks with no success. I want to block anything that isn't whitelisted. This is my idea on OS Centos 7: //Delete All Existing Rules iptables --flush ...
1
vote
1answer
37 views

what would be the Impact of using Multiple sites in same VPC on AWS platform?

I have a site running on four server inside of a VPC on aws platform. My question is would their be any impact on site if I host another website on four new server in the same VPC considering their ...
0
votes
0answers
20 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
1answer
96 views

How to block ApacheBench from sending requests to server?

I'm using Ubuntu 14.10, Apache 2.4. My server is under a huge DDoS attack right now, I tried to use mod_security , fail2ban and blocking attacking IPs manually using iptables and nothing worked. The ...
0
votes
1answer
83 views

How to defense a DDoS powered by end user's browser?

Like what Github.com has just experienced, what if a script provider, such as google ads, google analysis or something similar, add a malicious scripts at the end of their script, and let end users ...
0
votes
3answers
114 views

What is the most effective way to block IP address in Application Layer?

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
0
votes
0answers
43 views

“eth0: link up” kernel panick on debian - DDoS attack or soft / device issue

A few hours ago my dedicated machine in Hetzner went down. I was thinking what that was DDoS attack, or Hetzner network problem. But my other machine was working fine. So i loggined into Hetzner and ...
0
votes
2answers
48 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
1answer
180 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
1
vote
1answer
93 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
0
votes
0answers
33 views

How can node addition/substraction be done while keeping randomness in their connections in a P2P unstructured network?

If a unstructured P2P network that uses an admission mechanism for new peers entrance gets completely offline because of a massive attack (e.g. massive DDoS), after reconnecting, peers will try to ...
5
votes
2answers
194 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
3
votes
7answers
655 views

DDOS Attack Victim - How much to Admit?

Here's the environment: Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so Many Clients pay to use the site ...
2
votes
2answers
235 views

Monitor DoS attack with snmp [closed]

Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?
0
votes
1answer
3k views

Iptables ratelimit UDP DOS attacks [duplicate]

Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way, Attackers are ...