A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

11
votes
3answers
543 views

Dealing with NTP reflection attacks in IPTables

We're dealing with an NTP reflection / amplification attack at our colocated servers. This question is specific to responding to NTP reflection attacks, and not directed at DDoS in general. Here's ...
-1
votes
1answer
24 views

Run shell script on the event of “possible SYN flooding”

Since it doesn't appear to be possible to get "netstat" stats at the time I got an SYN flooding, I'd like to write a script that gets all the stats I need (top IPs, used memory, etc) and write to a ...
0
votes
1answer
27 views

Handle “possible SYN flooding on port 443. Sending cookies.”

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast. However, the server appears to ...
0
votes
0answers
19 views

DDos attack on port 80 and limiting connection does not work

I have a Centos server running apache 2.4 and someone keeps connecting to the server causing http requests to timeout. I have searched the internet for answers to solve this problem and someone asked ...
-4
votes
2answers
44 views

Does it make sense to have a server dedicated to login? [on hold]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
-1
votes
1answer
37 views

Server under attack [on hold]

I've got a DigitalOcean Debian server. And since yesterday the CPU has been at 100%. I use it for testing at the moment. I'm a newb with servers, so really got no clue what to do. Can someone ...
37
votes
6answers
45k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
0
votes
0answers
11 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
1
vote
1answer
37 views

CentOS 7 machine lost connectivity after DDoS attack [closed]

We were testing the DDoS protection of a CentOS 7 machine but after it ended, the connection on the machine is just gone. The configuration of the connection is exactly identical to before the DDoS ...
0
votes
0answers
26 views

Alghough TCP SYN Backlog size is set to 128 but in practical it is limited to 16

as you know in ubuntu, tcp syn backlog size is 128 by default. i tried to syn flood my ubuntu linux by hping3. to do that, i send 100 spoofed tcp syn packets per second to the ubuntu and meanwhile i ...
0
votes
1answer
26 views

Establishing TCP Connections by hping3

when a client sends 10 TCP SYN packets by hping3(not spoofing), server responds and sends 10 TCP SYN+ACK packets. now client should answer to server and Establish the connection by sending 10 ACK ...
0
votes
2answers
44 views

DDOS Attack without Matching Virtual Hosts

I'm getting very weird kind of DDOS attacks, the server is flooded with requests however the problem is, when going through the access log, is im getting different requests to non-existent domains and ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
9
votes
2answers
1k views

Is it possible to have a secondary managed DNS provider to quickly delegate to when DDOS attack on our *primary* external DNS provider happens?

So our DNS provider, every so often, experiences DDOS attacks on their systems that causes our front-facing web sites to go down. What are some options in terms of reducing dependency on a SINGLE ...
-1
votes
1answer
33 views

How can I only allow TCP connections for 1 port using iptables on Unbantu? How can I also set a maximum packet on a connection?

I'm running a server for public. I just want to allow TCP connections and I want to limit the packet to prevent ddosing a bit and setting a maximum IP/new connections per seconds with iptables. How ...
0
votes
1answer
23 views

Solid way to set up DDoS protection for a SaaS with many customer domains

I will be launching a SaaS soon. Customers will be able to sign up and get their own 'space'. Each customer will get a generated sub domain plus they can add their own custom domain if they wish too. ...
0
votes
1answer
644 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
0answers
30 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
1answer
67 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
0
votes
2answers
88 views

I'm trying to stress test a site but no hosting company will let me. What can I do?

We need to know what to expect if a rogue actor DDOSes one of our production sites, so I'm looking to spin up a few VPSes with web apps on so that I can simulate a DDOS against them with an online ...
-1
votes
2answers
37 views

Fallback between datacenters

What is the best way to do a fallback between datacenters. We have a dedicated server in one of the data centers and as our traffic increased i wanted to add more then backup i wanted redundancy and ...
1
vote
0answers
46 views

Using a VPS as front end proxy

I run a shell host that many users share which gets frequently DDoS'd (at least once every other month). So I have come up with a plan to peer all traffic with a VPS, so that it appears to everyone ...
0
votes
0answers
12 views

Ofbiz Ubuntu Server Vulnerability [duplicate]

My EC2 Instance is running ubuntu 14.04 and apache ofbiz-14.02. I found a python file was uploaded to server in ofbiz installation folder which I highly suspect it is the fraud by ofbiz which allowed ...
1
vote
0answers
43 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
32 views

nginx stub status SPIKES “writing” for a few seconds, causing 504 error. Why?! Bad VPS neighbour?

I am using Apache and nginx as reverse proxy, with php5-fpm. The latest week we've been receiving the following error in nginx's error.log: upstream timed out (110 connection timed out) while reading ...
-2
votes
1answer
117 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
0
votes
0answers
88 views

nginx req limit & fail2ban & cloudflare large attacks

I started to use as the topic says nginx with req limit + fail2ban + cloudflare. If someone exceeds the requests on any php file the ip gets blocked over the cloudflare api in the "ip firewall" on ...
0
votes
0answers
18 views

Mitigation DDOS Attack [duplicate]

I am with the OVH Dedicated server provider and we are under a DDOS attack, The mitigation toggles on and blocks everything on our server. Is there anyway to defend against 300k packets? In the ...
1
vote
2answers
18 views

Quantifying site response in case of DOS/DDOS attack tests

Let us say that we need to test a HTTPS web site for vulnerability/response in case of DOS/DDOS attacks. Among other tools, we can use GoldenEye for this purpose. We can vary the number of workers ...
1
vote
2answers
2k views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
-4
votes
2answers
118 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
2
votes
1answer
467 views

many graceful restarts in httpd error log?

Our server was down , and we restatred the services (nginx & httpd), and when i look at the logs, i've found these lines , there are so many Graceful restart requested, doing restart lines, whats ...
136
votes
4answers
11k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
0
votes
1answer
20 views

Preventing IP address from hitting Apache Tomcat by configuring Apache

We got Tomcat that needs to be restarted quite often on our production. Examining Apache access log file, I can see that certain IP addresses are hitting same logon page hundreds of times one after ...
0
votes
3answers
280 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk '{...
0
votes
1answer
36 views

how to block access for RSS Feed using htaccess

My website is experiencing RSS Feed problem I get this htaccess code Order deny,allow Deny from all Allow from xx.xx.xx.xx but it blocks all IP address i just need to block mywebsite.com/feed.php ...
-2
votes
1answer
65 views

Is this a DDoS attack? It's been overr 48 hours. What do I do? [closed]

I run a Wordpress on EC2 at AWS and I am facing the following issue: More than 2 days ago, the CPU went straight to 100% and the load balance up to ~20+ (for a 4-vcpu server) out of the blue. Being ...
0
votes
2answers
94 views

prevent from ddos attacks with nginx and apache (and haproxy?) [duplicate]

Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications. When the attack ...
1
vote
1answer
204 views

DDOS mitigation of GCE

I am hoping to start shared hosting service on Google Compute Engine. Does the Google infrastructure have any DDOS mitigation built-in? This article here says it does. "Compute Engine makes use of ...
0
votes
0answers
12 views

Digital Ocean locked my droplet saying it was compromised and participating in ddos. How can I look into this? [duplicate]

I have a digital ocean droplet and I got a support ticket sent to me saying they've had to lock my droplet because it was flooding their network, assuming it has been compromised and performing ddos ...
0
votes
0answers
42 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
1
vote
2answers
640 views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: http:/...
0
votes
1answer
61 views

Wrodpress DDOS /xmlrpc.php

This is what my nginx access.log looks like as I write this times infinity: 127.0.0.1 - - [19/Jan/2016:00:59:36 -0500] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; ...
0
votes
1answer
204 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
2
votes
3answers
106 views

My server is getting SYN Flooded, i have a few questions

my server is getting attacked, it seems to be a syn flood, and he is spoofing IP's. sudo netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns this. .....
2
votes
4answers
2k views

Can a DDoS attack stop me from SSH’ing into my server?

Can a DDoS attack stop me from ssh'ing into my server? My boss says no, therefore it must be something wrong with the server. However we are getting botted by 4-5 different bots even with robots.txt ...
0
votes
0answers
27 views

Clinet-side solutions to prevent DNS amplification without rate limiting on an open DNS server? [duplicate]

Are there alternative ways to operate an open/forwarding DNS server, without having to use rate limiting or other means of traffic inspection to prevent being used for DNS amplification attacks? ...
-1
votes
1answer
85 views

DDos attack ToS Violation - Outbound DoS [duplicate]

Fount ddos attack on ubuntu server netstat -nputw given outout Local Address Foreign Address State PID/Program name 55.57.72.37:59792 123.166.137.95:25000 SYN_SENT 2890/...
-1
votes
2answers
75 views

AWS DNS DDoS mitigation

I have an AWS server that is currently under DDoS via DNS amplification. I've setup CloudWatch logs for the VPC ACL and it's logging an enormous amount of rejected DNS traffic. Despite that traffic ...
0
votes
1answer
380 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...