Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms (1)

3
votes
2answers
607 views

Weird Requests Being Sent to My Server [duplicate]

I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my ...
0
votes
1answer
24 views

How can I tell if a cisco router is dropping pings due to DOS suspicion or if it's experiencing packet loss?

We use a PRTG server that's connected to a cisco 6500, which feeds a large network of about 1200 switches and radios in a router-on-a-stick topology. In PRTG I'm able to set a 'ping burst' sensor on a ...
0
votes
4answers
139 views

How do I check if my VPS participated in a brute force or denial of service attack? [closed]

On VPS what logs do I have check and what type of information should I check for to find out if my server participated in a brute force or denial of service attack? I have the targeted IP address ...
1
vote
1answer
44 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
1
vote
1answer
39 views

Drupal application load troubleshooting

I'm receiving some sporadic high server load on a Drupal application (really high. 8 cores, load average of 50). The load is normally sitting between 5-10. The Drupal application sits behind a ...
0
votes
1answer
52 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
4
votes
1answer
1k views

What does enable DoS protection in Synology DSM 5 do?

If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked? The text reads "Denial-of-Service (DoS) protection helps to prevent ...
1
vote
1answer
936 views

Kali SYN Flood (Metasploit), not denying service

I have a server with apache2 installed. I tried to do a dos attack on the server by using kali linux syn flood attack, but i am still able to access the website on the server. msf auxiliary(synflood) ...
4
votes
1answer
130 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. ...
1
vote
2answers
492 views

trustwave pci scan: dns amplification denial of service, Bind 9.8.1-P1, doesn't seem like it

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service". Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: ...
0
votes
0answers
31 views

Intelligently filtering bogus query strings

A vBulletin site I maintain is on the wrong end of a DoS attack which is inexplicably routing through CloudFlare unimpeded by their DoS protection. The requests look like this: 1 /?ZZZZCQG=XJXAUD ...
-3
votes
1answer
489 views

Acunetix surfaces a Slow HTTP vulnerability, how do I protect against slowloris?

How to protect from slowloris ? I have installed mod_antiloris and mod_qos and acunetix still warn about slowloris. mod_antiloris and mod_qos are loaded Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 ...
1
vote
0answers
304 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
0
votes
3answers
286 views

How to protect server from simple DoS attack

Please note I am NOT asking how to protect server from DDoS. What I mean is that if someone runs siege -c 1000 www.example.com on his VPS. That will result in my server serving thousands of requests ...
0
votes
1answer
78 views

Abort any POST VERB operation in IIS

My site is getting DOS attack with POST VERB, my site is a static site and I am trying to stop any POST action on the home page. I had the URL Rewrite installed on my server, so I am trying to write ...
-2
votes
1answer
860 views

Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]

The site is a simple penny auction site. The site runs on: MySQL PHP At any given time: an auction can have 100 - 2000 concurrent users. each user has one single "long poll" running in the ...
1
vote
0answers
76 views

Cause for large number of duplicate web requests

I am seeing odd traffic to my web site. On occasion, probably a few times a day, I will get a flurry of requests for the same URI from the same IP address for several minutes, at rates from maybe one ...
0
votes
1answer
54 views

Under DoS, how to alter MediaWiki to reject quickly any editing and history requests for anonymous users

One of our MediaWiki - based projects seems under DoS attack - unusual number of anonymous users try to edit pages and view or edit history requests. While anonymous editing is disabled on that ...
1
vote
0answers
89 views

Preventing NFS Denial of Service

I have a NFS4 server running Ubuntu 10.04 Server, on an enterprise environment with 50+ clients. Overall, everything works fine, but from time to time, some client starts making +1000 NFS operations ...
0
votes
3answers
669 views

Is this a denial of service attack?

I have my kern.log flooded by these lines: Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 ...
11
votes
5answers
13k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
8
votes
2answers
2k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
0
votes
4answers
2k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
6
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
4
votes
2answers
309 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
1
vote
2answers
289 views

Block packets based on length

Can I block packets (Specifically UDP) that are > X length? I am getting attacked exclusively by UDP packets that are very large in size from a large number of IP Addresses. I have a legitimate use ...
1
vote
3answers
880 views

ESXi server under DoS attack, can I use SSH to determine where from? [duplicate]

My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host. I ...
0
votes
1answer
3k views

DNS Server being used for Amplified DNS Attack - ripe.net

We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the ...
-2
votes
4answers
436 views

Getting attacked, what do I do? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm getting millions of these requests in my Apache access log. How do I stop them? 173.59.227.11 - - [30/May/2012:18:23:45 -0400] ...
3
votes
1answer
185 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
5
votes
3answers
1k views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
1
vote
5answers
743 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
3answers
1k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
6
votes
2answers
1k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
1
vote
2answers
3k views

Kernel Printk: xx message suppressed

Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
2answers
117 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
1answer
613 views

DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response

In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-4
votes
1answer
374 views

Wich module to defend my apache server? [closed]

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
3
votes
2answers
1k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...
2
votes
1answer
3k views

nginx: Prevent DoS by limiting worker processes/connections

If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable? Basically, I'm trying to secure my ...
2
votes
2answers
225 views

How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned ...
3
votes
4answers
2k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a ...
1
vote
1answer
409 views

Apache's built-in anti-dos mechanism by returning code 403?

In the process of learning more about how to survive simple DoS attack for my Apache server, I found some script to initiate attack on my own server and I notice that Apache returns error code 403 ...
3
votes
2answers
944 views

iptables rate-limit module problem

I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks). In my rules I have something like: ...
2
votes
1answer
431 views

Where can I find DoS attack simulator [closed]

I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc... Could someone please ...
1
vote
1answer
151 views

Is it normal to collapse VPS CPU with this script?

This is the script, it comes with mod_evasive: #!/usr/bin/perl #test.pl: small script to test mod_dosevasive's effectiveness use IO::Socket; use strict; for(0..100) { my($response); ...
0
votes
2answers
146 views

defend dos attack

my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second. Is there a way to defend this kind of attack? Is there a way to trace back to the ...
0
votes
2answers
239 views

iptables logs but doesn't drop packets

I am trying to create some simple iptables DOS protection rules for my web server. I was doing testing on the following rules: iptables -N LOGDROP > /dev/null 2> /dev/null iptables -F LOGDROP ...
1
vote
1answer
89 views

Can't figure out this attack, getting botnets and something else

About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out. My site is not ...
2
votes
2answers
871 views

Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log

I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...