A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

3
votes
1answer
233 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
1
vote
1answer
656 views

Firewall UDP Flood Dos/DDoS

Recently I have been suffering from what appears to be a UDP query flood attack. I am looking for a way to block the attack using a software firewall such as iptables, this should be possible, as ...
1
vote
1answer
662 views

DDOS prevention/mitigation on Linux CentOs server using IP tables

One of our servers has generated a 19Gb access.log in the space of about 24 hours and the server went down in this time. We'd like to implement some measures to safeguard against DDOS attacks but ...
1
vote
1answer
276 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
1
vote
1answer
196 views

Bingbot spoof localhost ip

So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request: 127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" "...
0
votes
1answer
27 views

Solid way to set up DDoS protection for a SaaS with many customer domains

I will be launching a SaaS soon. Customers will be able to sign up and get their own 'space'. Each customer will get a generated sub domain plus they can add their own custom domain if they wish too. ...
0
votes
1answer
121 views

Should I expect reception of packets in hping3 --flood?

I'm testing a newly purchased VPS for DDoS vulnerability using hping3. If I do not use --flood, everything goes fine and I see close to 0% packet loss every time. But If I do use --flood, then the ...
0
votes
1answer
288 views

NGINX not responding during DDoS attacks

I'm going to get straight to the point, NGINX doesn't seem to handle any HTTP requests during a DDoS attack using XML-RPC. The server only uses about 1% of the CPU during an XML-RPC DDoS attack. The ...
0
votes
1answer
138 views

Nginx limit_conn inheritance

I am trying to protect Drupal running on Nginx from simple DDoS with limit_conn and limit_req. But I encountered some strange behavior with inheritance of limit_conn directive which I cannot explain. ...
0
votes
1answer
438 views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
0
votes
1answer
72 views

slow post attack mitigation breaks slow file uploads

To mitigate against slow post attacks, I set the following in my apache. RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500 The problem with this is when users are uploading files on ...
0
votes
1answer
106 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
0
votes
1answer
84 views

Content Redirection Attack on a Server

I'm working with an apache 2.2 server that is receiving lots of requests for content that does not exist on the server (edit: the specific content request changes frequently). It appears to be an ...
0
votes
1answer
210 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
0
votes
1answer
576 views

GRE Tunnel in CentOS

How to create a GRE Tunnel in CentOS pointing all connections to server A for the server B? I have a public server with DDoS protection and need to use this as a firewall to filter acess to the other ...
0
votes
1answer
321 views

Lots of connections to loopback, could be slowing us down

I'm trying to debug a sudden increase in our load average. I looked at this page to see if we were being DDoS'ed but the standout IP address was the loopback address: $ netstat -ntu | awk '{print $5}'...
0
votes
1answer
607 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
0
votes
1answer
55 views

Is there a service I can redirect/report DDoS clients to?

Currently experiencing a very mild DDoS attack. Just a brute force login attack. This caused a spike in PHP/MySQL usage so I've just blocked logins except from my IP address. I'm not too worried about ...
2
votes
0answers
481 views

sshd running at 100%

I'm running an Ubuntu/WordPress server on Amazon EC2 which is experiencing problems every 24-48 hours: I get a CPU alarm from EC2, log into the server, and discover sshd is running at 99.9% CPU. This ...
1
vote
0answers
30 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
0answers
51 views

Using a VPS as front end proxy

I run a shell host that many users share which gets frequently DDoS'd (at least once every other month). So I have come up with a plan to peer all traffic with a VPS, so that it appears to everyone ...
1
vote
0answers
44 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
35 views

nginx stub status SPIKES “writing” for a few seconds, causing 504 error. Why?! Bad VPS neighbour?

I am using Apache and nginx as reverse proxy, with php5-fpm. The latest week we've been receiving the following error in nginx's error.log: upstream timed out (110 connection timed out) while reading ...
1
vote
0answers
52 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
1
vote
0answers
113 views

Drop first packet for every IP with iptables

My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets. Is there a way to drop the first packet received ...
1
vote
0answers
122 views

Kernel panic under DDOS

I'm running a Debian 6 - 64bit system (Kernel 2.6.32-5-amd64) and often get flooded with DDOS. I have tuned the network parameters under /etc/sysctl.conf to not let any kernel parameter overflow. ...
1
vote
0answers
122 views

Recommended values for DIPR configuration on a web-server

Microsoft has this great module for IIS server: The Dynamic IP Restrictions (DIPR) module for IIS 7.0 and above provides protection against denial of service and brute force attacks on web ...
1
vote
0answers
172 views

Is it DDOS attack?

For three successive days, now, I'm having four or five unique servers' queries being denied by my csf firewall, which are renamed in the following extract I got from my log as "www.example1.com", "...
1
vote
0answers
694 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly different....
1
vote
0answers
72 views

Multiple DDOS protection interfaces merging on one TS server

The problem I have is I have 3 DDOS protection interfaces from a multi homed DDOS protection solution and teamspeak is refusing to return packets via the correct interface (aka the one that sent it ...
1
vote
0answers
151 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
0answers
17 views

(D)DoS Detection within linux and IPTables

We currently have a hardware firewall running on Ubuntu 14.04 on a 10Ge network. We use this to filter traffic and attacks, this is all working great and we have blocked quite a lot of DNS/NTP attacks....
0
votes
0answers
13 views

netstats shows my own server is hitting a server its not supposed to know about

ON AWS I have a few dedicated servers that do image processing and they seem to get high traffic and fail. when running netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n I ...
0
votes
0answers
33 views

Alghough TCP SYN Backlog size is set to 128 but in practical it is limited to 16

as you know in ubuntu, tcp syn backlog size is 128 by default. i tried to syn flood my ubuntu linux by hping3. to do that, i send 100 spoofed tcp syn packets per second to the ubuntu and meanwhile i ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
115 views

nginx req limit & fail2ban & cloudflare large attacks

I started to use as the topic says nginx with req limit + fail2ban + cloudflare. If someone exceeds the requests on any php file the ip gets blocked over the cloudflare api in the "ip firewall" on ...
0
votes
0answers
42 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
0
votes
0answers
153 views

I can DDOS my server with one client by doing ctrl+F5

First of all I really don't know where I should start my investigation. I'll post the configuration files as soon as you'll ask. The server is windows 2008 R2 with Apache 2.4.9 and PHP 5.6. on a VM, ...
0
votes
0answers
59 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
0answers
46 views

nginx deny POST requests to the index route

i recently noticed DDos-like attacks on my server and now i'm in charge of trying to reduce the damage they deal. They aren't that heavy, but it's enough for the poor performance my server delivers. ...
0
votes
0answers
69 views

Php5-cgi, 503 error or DDoS attack?

I am trying to figure out if these things are connected. Until yesterday I had some CPU/RAM spikes on random times that could last for hours/days all connected with 30-40 php5-cgi processes being run ...
0
votes
0answers
87 views

How to prevent outgoing UDP flood

I've been googling for hours now but can't find a sure or helpful answer. I need to disable high-volume outgoing UDP from my server. I'm trying to configure APF because of the RAB functionality, but ...
0
votes
0answers
52 views

Use extra firewall to filter WAN traffic before reaching UTM?

I am running a simple web server behind UTM, only port 80,443 is open. However almost 80% of the traffic coming through WAN is trouble. Mostly are port scanners / sniffers or systematically querying ...
0
votes
0answers
188 views

limit_req on nginx not working

Iam using Ubuntu server 14.04 with apache + nginx proxy over it. I tried to set up limit_req in /etc/nginx-sp/nginx-sp.conf as this: http { limit_req_zone $binary_remote_addr zone=one:1m rate=...
0
votes
0answers
354 views

Make NGINX Block All Requests To Direct Server IP - Stop XML-RPC Attacks

Essentially, my website is being attacked by a layer 7 XML-RPC attack and is currently offline and has been offline so I am in need of desperate help. Any assistance would be greatly appreciated :)! ...
0
votes
0answers
341 views

Using an Ubuntu VPS as a firewall/router

I have a dedicated server running ubuntu 12.04 hosting several websites and other applications which require client IP's to be visible, however the main dedicated server does not have DDoS protection, ...
0
votes
0answers
280 views

My VPS send an outbound attack

My VPS was sending an large outbound attack 10MB/s. It's normal max 300Kb/s I've tried searching around the internet, look for some /tmp folder, installed Linux Malware Detect, installed csf with ...
0
votes
0answers
2k views

Apache Server 2.4 on EC2 “caught SIGTERM shutting down ”

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down: [Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] ...
0
votes
0answers
348 views

My Bitnami Tomcat Stack (on EC2 AWS) is generating DoS attack

I have a very small java web app that is deployed on a Bitnami Tomcat Stack on AWS. We are using this app in the company with only 5-10 user base daily, and generating only below 100MB of traffic per ...
0
votes
0answers
300 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...