A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

2
votes
0answers
29 views

Getting DDoSed with requests for links to other sites and Bittorrent and BingBar [duplicate]

The other day my server started getting slow and the logs showed it was being heavily spammed with strange requests like for BingBar, 218.94.73.210 - - [22/Apr/2015:13:25:37 +1200] "GET ...
0
votes
1answer
16 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
9
votes
6answers
668 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
2
votes
4answers
2k views

Where to find and how to block blacklisted IPs and proxies?

Good day everyone! I'm looking for a way to block incoming requests from blacklisted IPs and proxies (mostly anonymous) to my server. While it's quite obvious how to do it using Apache config the ...
0
votes
0answers
44 views

Kernel panic under DDOS

I'm running a Debian 6 - 64bit system (Kernel 2.6.32-5-amd64) and often get flooded with DDOS. I have tuned the network parameters under /etc/sysctl.conf to not let any kernel parameter overflow. ...
-1
votes
2answers
41 views

IPTables not blocking IPStresser [closed]

I have been trying four days to block DDoS attacks with no success. I want to block anything that isn't whitelisted. This is my idea on OS Centos 7: //Delete All Existing Rules iptables --flush ...
1
vote
1answer
31 views

what would be the Impact of using Multiple sites in same VPC on AWS platform?

I have a site running on four server inside of a VPC on aws platform. My question is would their be any impact on site if I host another website on four new server in the same VPC considering their ...
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
1answer
36 views

How to block ApacheBench from sending requests to server?

I'm using Ubuntu 14.10, Apache 2.4. My server is under a huge DDoS attack right now, I tried to use mod_security , fail2ban and blocking attacking IPs manually using iptables and nothing worked. The ...
0
votes
1answer
62 views

How to defense a DDoS powered by end user's browser?

Like what Github.com has just experienced, what if a script provider, such as google ads, google analysis or something similar, add a malicious scripts at the end of their script, and let end users ...
0
votes
3answers
64 views

What is the most effective way to block IP address in Application Layer?

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
0
votes
0answers
28 views

“eth0: link up” kernel panick on debian - DDoS attack or soft / device issue

A few hours ago my dedicated machine in Hetzner went down. I was thinking what that was DDoS attack, or Hetzner network problem. But my other machine was working fine. So i loggined into Hetzner and ...
-2
votes
0answers
26 views

Dos Attack Server python java [duplicate]

I dont know what is going on on my server. RamNode just adviced me that my VPS appears to e sending out DoS attacks. I restarted the server and did htop and found this: gyazo
0
votes
1answer
894 views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
0
votes
2answers
45 views

What is the benefit of cloudfares or inkapsulas etc ddos protection [closed]

My Server get even more attacked via DDOS. And im thinking about buying a service like cloudfare or incapsule for preventing DDOS. But i dont understand one thing. When the attackers see that the ...
0
votes
1answer
92 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
1
vote
1answer
41 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
0
votes
0answers
33 views

How can node addition/substraction be done while keeping randomness in their connections in a P2P unstructured network?

If a unstructured P2P network that uses an admission mechanism for new peers entrance gets completely offline because of a massive attack (e.g. massive DDoS), after reconnecting, peers will try to ...
5
votes
2answers
143 views

How do I understand my CPU usage on a DNS server?

I have read and understood Can you help me with my capacity planning?, but I'm not sure I understand what my next steps are in a DNS server scenario. I think my CPU loads are high or that I might be ...
3
votes
7answers
644 views

DDOS Attack Victim - How much to Admit?

Here's the environment: Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so Many Clients pay to use the site ...
2
votes
2answers
226 views

Monitor DoS attack with snmp [closed]

Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?
0
votes
1answer
3k views

Iptables ratelimit UDP DOS attacks [duplicate]

Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way, Attackers are ...
0
votes
2answers
578 views

Prevent scanning of the Apache's /default directory [duplicate]

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server. I have checked Apache log and somebody is ...
0
votes
1answer
1k views

Best Practice for captcha based protection against D.O.S to Nginx Proxy [duplicate]

The idea is explained here In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers. If the number of request times within a certain period from ...
2
votes
1answer
162 views

How can I implement an ip whitelist to protect my server? [duplicate]

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
4
votes
1answer
228 views

Windows server 2008, a very small DDoS is able to kill my server [duplicate]

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 ...
-3
votes
1answer
188 views

Is this DoS attack [duplicate]

I am seeing a huge number of connections from a single IP. # netstat -alpn | grep :80 | grep 92.98.64.103 tcp 0 0 my.ip.address.x:80 92.98.64.103:45629 TIME_WAIT - ...
0
votes
1answer
209 views

iptables connection limit does not work on debian [duplicate]

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
0
votes
2answers
307 views

netfilter ip_conntrack and (d)DoS [duplicate]

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
1
vote
2answers
336 views

PHP web hosting: how to prevent clients to DOS/DDOS? [duplicate]

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts. Besides the security routine I'll have to check (off topic here) I would like to know ...
-1
votes
1answer
403 views

TCP DOS: How to terminate CLOSE_WAIT connections? [duplicate]

One of my servers is getting DOS'ed - there are a large number of connections in the CLOSE_WAIT state which are preventing legitimate users from connecting to the system. So is there any way to close ...
4
votes
2answers
104 views

Will MX records with a longer TTL help mitigate effects of DoS attack? [duplicate]

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
1
vote
2answers
272 views

blocking udp attack ip with iptables [duplicate]

I was trying to block an ip of ( network stresser tool - a ddos websites selling ddos bots by seconds online ) the first one i was trying to block with iptables : iptables -A INPUT -d 173.193.26.73 ...
0
votes
1answer
16 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
0
votes
0answers
37 views

We're getting a lot of strange requests to our server [duplicate]

we recently started getting a lot of strange requests to our server, and it can't handle it. Some examples from our access log: 120.198.243.34 - - [16/Feb/2015:10:26:02 +0100] "GET ...
4
votes
3answers
386 views

I know how to scale my software, but how to prevent downtime because of network outages? [duplicate]

We are running rather large LAMP sites which scale well software wise. We use redundant load balancers in front of a bunch of webservers using MySQL via a proxy in master-slave-slave-slave. We are ...
0
votes
3answers
354 views

DDoS Network Protection Devices

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks? What devices (like cisco guard, etc) do you recommend and what's the user ...
0
votes
1answer
40 views

Email Virus initiating a DOS Attack [duplicate]

I have a VPS that keeps getting shut down because of excessive inbound or outbound traffic. I thought I had a virus on my server and with it shut down so was my email server. So I got a new VPS ...
2
votes
4answers
1k views

Does a VPS mitigate risks of a DDOS attack versus shared hosting?

A client of mine has a website on a shared hosting account, and one of the other accounts on that server was targeted by a DDOS attack, which of course brought all of the websites on that server down. ...
2
votes
1answer
34 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
1
vote
3answers
163 views

Does CloudFlare make a site a greater potential DDOS target?

CloudFlare has gotten a lot of press recently as protecting businesses from DDOS attacks. But from looking at their twitter feed, it looks like they are targeted every day, and large segments of their ...
0
votes
2answers
195 views

My servers are overloaded with random GET requests. Why? [duplicate]

I'm getting a huge amount of traffic to web servers looking for bittorrent type queries: 110.152.78.14 - - [27/Jan/2015:01:45:22 +0000] "GET ...
13
votes
2answers
1k views

Has anyone got billed for malicious activities (DDoS) on a cloud server? [closed]

I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues? Thank you!
0
votes
1answer
49 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
-6
votes
1answer
183 views

What are some acceptable easy solutions against DDOS? [duplicate]

IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd). Would changing ...
0
votes
1answer
40 views

Content Redirection Attack on a Server

I'm working with an apache 2.2 server that is receiving lots of requests for content that does not exist on the server (edit: the specific content request changes frequently). It appears to be an ...
0
votes
0answers
578 views

High outbound network traffic on Tomcat under process nodeJR [duplicate]

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...
1
vote
3answers
1k views

What “Syn Proxy Servers” are recommended? Or how to build one?

My questions are: 1.) What is a recommended "SYN PROXY SERVER" to filter bogus SYN Attacks and only forward "handshaked" valid connections to the host behind it (to be protected). I search the term, ...
-1
votes
1answer
51 views

Are Google Apps implicitly DDoS protected?

Especially when talking about Google's Project Shield, people refer to an "internal anti-DDoS infrastructure". I could not find any more detailed information on such thing, and if it spans all the ...
0
votes
0answers
28 views

Suddenly many requests to /announce on server [duplicate]

We currently receive a lot of unusual requests on our Apache2 web server which impair the server's performance. Most requests go to /announce and /announce.php. Both addresses do not exist - 404. Here ...