A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

80
votes
1answer
4k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
2
votes
4answers
4k views

How can I stop a currently active DDoS attack? [duplicate]

My VPS is under a DDoS attack. I cannot access RDP, and I cannot take it offline, or access it in any way at all. What can I do? They are not trying to bruteforce, just trying to stop access to the ...
4
votes
2answers
2k views

SYN Flood Advice

Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a ...
8
votes
7answers
7k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
3
votes
3answers
3k views

Protecting Hosted Windows 2008 Servers against DDOS Attacks

Followup to Identifying DDOS Attacks on Windows 2008 Servers. What steps are people taking to prevent DDOS attacks against their Windows 2008 Servers in a hosted environment? I'm particularly ...
1
vote
4answers
1k views

Where to find and how to block blacklisted IPs and proxies?

Good day everyone! I'm looking for a way to block incoming requests from blacklisted IPs and proxies (mostly anonymous) to my server. While it's quite obvious how to do it using Apache config the ...
8
votes
8answers
14k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
4
votes
2answers
7k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
4
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
2
votes
3answers
816 views

Am I getting DDoSed, and what should I about it?

At the moment my server is lagging pretty bad, and it crashes. It's a dedicated server which has run completely fine last two days. What does this command do? netstat -n|grep :80|cut -c 45-|cut -f 1 ...
0
votes
1answer
235 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
13
votes
9answers
30k views

Server under DDOS attack - How to find out IPs?

My server is under DDOS attacks and I want to block the IP that is doing it, what logs should I be looking for to determine the attacker's IP?
3
votes
1answer
6k views

How can I detect a DDoS attack using pfSense so I can tell my ISP who to block? [duplicate]

Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host. I understand (from this ...
8
votes
3answers
887 views

RedStation.com is heaven for ddos attackers, How to file complaint? [closed]

Sorry, I don't know where to open this subject. This is not the first time we have faced with a massive DDOS attack from one of servers in RedStation.com and even after we had contacted with their ...
0
votes
2answers
3k views

DNS Server Spoofed Request Amplification DDoS - Prevention

I've been conducting security scans, and a new one popped up for me: DNS Server Spoofed Request Amplification DDoS The remote DNS server answers to any request. It is possible to query the ...
4
votes
2answers
6k views

How Can I Harden the TCP/IP Stack in Windows Server 2008? [duplicate]

I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks. There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
5
votes
1answer
101 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
2
votes
3answers
5k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
1
vote
1answer
1k views

Logging Timeout'd Request in Apache 2.X

I am migrating some applications from Apache 1.3 to 2.2. We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 ...
3
votes
5answers
2k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
2
votes
4answers
3k views

How to protect Lighttpd from DOS attacks and flooding? [duplicate]

I have a problem with Lighttpd because someone started to use some Web downloader from very good connection and it blocked my whole website. Is there any way to protect Lighttpd from DDOS attacks and ...
1
vote
1answer
430 views

Nginx - Redirect request by GET parameters pattern

One of my servers was attacked by DDoS a couple of days ago and it lasted for 4 days. Below are the logs snippet of the request: 36.224.180.253 - - [14/May/2013:03:11:46 +0800] "GET ...
1
vote
5answers
631 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
0
votes
4answers
845 views

Getting a lot of hits on my web server and it's taking down my httpd. Possible DDoS? [duplicate]

I'm getting a lot of hits on my server. This server normally gets little to no traffic yet there's is constant hits every time I bring the server back up. I get the following error first ...
-6
votes
1answer
179 views

What are some acceptable easy solutions against DDOS? [closed]

IIRC the best way is to set up a firewall. But what are some easy solutions that doesnt require a lot of knowledge? I use nginx (but i hope the solution can be applied to lighttpd). Would changing ...