A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

learn more… | top users | synonyms

0
votes
2answers
250 views

Protection against scrapping with nginx

This morning we had a crawler going nuts on our server hitting our site almost 100 times per second. We'd like to add a protection for this. I guess I'' have to use HttpLimitReqModule but I don't ...
3
votes
1answer
176 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
2
votes
1answer
438 views

SynFlood attack, spoofed IPs, syncookies mitigation

Due to a recent increase in SynFlood attacks on my company's systems i've been testing by Syn flooding the hosts myself to see how easy they are to disrupt, and the answer is 'quite easy'. By using a ...
1
vote
1answer
127 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
1
vote
1answer
73 views

How to setup Microsoft DNS so it does not contribute to DNS amplification attacks

I am using a Microsoft DNS server to host both our internal and external DNS. This means that recursive lookups needs to be turned on, or internal users will not be able to perform DNS queries. ...
1
vote
1answer
121 views

Bingbot spoof localhost ip

So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request: 127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" ...
1
vote
1answer
523 views

Mitigate DDoS attack by Null-routing my server's IP?

My services were attacked by what appears to be a botnet of quite a large number of computers. Since all my servers have additional IPs, and my hosting provider lets me null-route my IP addresses to ...
0
votes
1answer
61 views

GRE Tunnel in CentOS

How to create a GRE Tunnel in CentOS pointing all connections to server A for the server B? I have a public server with DDoS protection and need to use this as a firewall to filter acess to the other ...
0
votes
1answer
46 views

there is empty ips in netstat

I have installed ddos deflate on my sever (centos6.5 64bit) and in server mailbox I see that ddos deflate has been blacklisted empty Ip. and when I run this command on ssh I see: netstat -ntu | awk ...
0
votes
1answer
72 views

Lots of connections to loopback, could be slowing us down

I'm trying to debug a sudden increase in our load average. I looked at this page to see if we were being DDoS'ed but the standout IP address was the loopback address: $ netstat -ntu | awk '{print ...
0
votes
1answer
340 views

.htaccess rules to stop DDoS POST flooding

We're under a distributed denial of service attack from traffic that looks like this: 49.146.161.175 - - [11/Jul/2014:00:43:42 -0400] "POST / HTTP/1.1" 500 557 "-" "Mozilla/4.0 (compatible; MSIE 6.0; ...
0
votes
1answer
292 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
0
votes
1answer
713 views

How to prevent mod_evasive false positives on partial downloads of large files

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many ...
0
votes
1answer
47 views

Is there a service I can redirect/report DDoS clients to?

Currently experiencing a very mild DDoS attack. Just a brute force login attack. This caused a spike in PHP/MySQL usage so I've just blocked logins except from my IP address. I'm not too worried about ...
0
votes
1answer
326 views

How to interpret this jnettop output?

Looks like I'm currently under a DOS attack or something like that, I've been monitoring the traffic on the server using jnettop, this is a of what I see during normal conditions: ...
0
votes
1answer
208 views

Automation of blocking IP address

I have an Ubuntu 12.04 machine running Apache2 which hosts about 10 wordpress websites. Recently I have been subjected to attacks from clients which seem to be sending POST requests to a wordpress ...
0
votes
1answer
42 views

My site is inaccessible from different locations on-and-off. What's happening?

On-and-off for the last few days, my sites (www.)aderet.org and to a lesser extent (www.)saveadullam.org have been down from (two different networks in) Israel. Over a period of minutes or seconds, ...
0
votes
1answer
153 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
1answer
181 views

Server Recovery from Denial of Service

I'm looking at a server that might be misconfigured to handle Denial of Service. The database was knocked offline after the attack, and was unable to restart itself after it failed to restart when the ...
0
votes
1answer
165 views

Single IP attack or other issue?

Description of incident: I notice in my MRTG panel that httpd processes have climbed to 800 ( our maximum ), but all other parameters are normal ( cpu, memory, traffic ) I immediately ran a nestat ...
-1
votes
1answer
51 views

How to tell if the server was down because of DDoS of another reason?

my server was down for a couple of hours during the night. i see in the cpu load monitoring in the amazon AWS console that it was 100% load. also, the network in jumped (but no that dramatically) so ...
2
votes
0answers
214 views

sshd running at 100%

I'm running an Ubuntu/WordPress server on Amazon EC2 which is experiencing problems every 24-48 hours: I get a CPU alarm from EC2, log into the server, and discover sshd is running at 99.9% CPU. This ...
1
vote
0answers
278 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
46 views

Multiple DDOS protection interfaces merging on one TS server

The problem I have is I have 3 DDOS protection interfaces from a multi homed DDOS protection solution and teamspeak is refusing to return packets via the correct interface (aka the one that sent it ...
1
vote
0answers
130 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
0answers
31 views

Using an Ubuntu VPS as a firewall/router

I have a dedicated server running ubuntu 12.04 hosting several websites and other applications which require client IP's to be visible, however the main dedicated server does not have DDoS protection, ...
0
votes
0answers
41 views

My VPS send an outbound attack

My VPS was sending an large outbound attack 10MB/s. It's normal max 300Kb/s I've tried searching around the internet, look for some /tmp folder, installed Linux Malware Detect, installed csf with ...
0
votes
0answers
37 views

How to redirect to an other link when excess request (limit_req) with Nginx

I have been trying to limit the requests coming from a single IP address successful with module limit_req in Nginx. But now I want to redirect to an other web-page for showing some messages.How could ...
0
votes
0answers
436 views

Apache Server 2.4 on EC2 “caught SIGTERM shutting down ”

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down: [Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] ...
0
votes
0answers
35 views

Recommended values for DIPR configuration on a web-server

Microsoft has this great module for IIS server: The Dynamic IP Restrictions (DIPR) module for IIS 7.0 and above provides protection against denial of service and brute force attacks on web ...
0
votes
0answers
88 views

Is it DDOS attack?

For three successive days, now, I'm having four or five unique servers' queries being denied by my csf firewall, which are renamed in the following extract I got from my log as "www.example1.com", ...
0
votes
0answers
121 views

How do you protect your <appid>.appspot.com domain from DDOS attack?

If I want to use CloudFlare to help protect my GAE app via it's custom domain, I still am vulnerable to attacks directly on the .appspot.com domain. How do I mitigate that? I could force redirect ...
0
votes
0answers
541 views

High outbound network traffic on Tomcat under process nodeJR

We are investigating high outbound traffic on Tomcat servers hosted on AWS instances. The specific question I have is what the process nodeJR is - and how it could get installed under Tomcat? The ...
0
votes
0answers
247 views

Apache2 php-cgi processes, how to limit them?

I have a 32gig ram dedicated server running on Ubuntu 12.04 with ISPConfig / Apache configuration. The thing is, anyone can take the site down simply by holding down F5 button for 20 seconds causing ...
0
votes
0answers
225 views

My Bitnami Tomcat Stack (on EC2 AWS) is generating DoS attack

I have a very small java web app that is deployed on a Bitnami Tomcat Stack on AWS. We are using this app in the company with only 5-10 user base daily, and generating only below 100MB of traffic per ...
0
votes
0answers
25 views

Intelligently filtering bogus query strings

A vBulletin site I maintain is on the wrong end of a DoS attack which is inexplicably routing through CloudFlare unimpeded by their DoS protection. The requests look like this: 1 /?ZZZZCQG=XJXAUD ...
0
votes
0answers
369 views

Blocking a TCP Syn Attack

I have recently experienced a TCP Syn attack and since it was from a software like LOIC, it kept happening until I banned the IP Addresses or stopped my system from making output to them. Here is what ...
0
votes
0answers
356 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
0
votes
0answers
234 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...