Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms (1)

-1
votes
1answer
26 views

How to duplicate a DoS attack

I've a WP blog who have received a DoS attack last days. server start using all CPU and memory, and eventually stop replying http request. It's a POST request to xmlrpc.php, I've checked the content ...
0
votes
1answer
18 views

Network interface fails to come up under heavy traffic

We're investigating an issue with our kit, which is an IP camera running Busybox Linux on a Ti-Davinci SoC. On one particular site there is a lot of network traffic (over which we do not have ...
0
votes
1answer
32 views

How does CT_LIMIT (the csf firewall setting) work?

I've been wondering if the csf firewall counts the connections for the last CT_INTERVAL seconds and then compares them to the CT_LIMIT value, or it just counts the current (at the moment) connections ...
0
votes
2answers
21 views

Large request body DoS attacks - is this really much of a concern?

Can anyone explain why limiting the maximum request body size is useful for preventing DoS attacks? ModSecurity defaults to 1MB for example with SecRequestBodyNoFilesLimit. I guess I'm wondering ...
1
vote
2answers
52 views

Is it normal for a VPS provider to claim DoS attacks often? [closed]

I have been using a well-known VPS service for over an year. Everything is good except one thing that once in a while, there will be some DoS attack. And when it happens, my server becomes ...
0
votes
1answer
38 views

Should I expect reception of packets in hping3 --flood?

I'm testing a newly purchased VPS for DDoS vulnerability using hping3. If I do not use --flood, everything goes fine and I see close to 0% packet loss every time. But If I do use --flood, then the ...
2
votes
1answer
146 views

Nginx too many open files DDOS

Im having an issue with ddos at the moment. My web server is behind a reverse-proxy (cloudflare), which I know shouldn't be relied on with their free plan. Cloudflare is in under-attack-mode, which ...
0
votes
0answers
76 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
1
vote
2answers
272 views

How do I stop a simple DDOS attack?

There is a hacker who is mad at us, and has started a DDOS attack against us. I think he is a script-kiddie, using tools like DarkComet; the attack is probably simple. I host a server on my PC. The ...
-2
votes
3answers
87 views

Use two or more IP addresses to prevent DoS attacks [duplicate]

N00b question But say I had a dedicated server with two IP addresses, and the software (We'll just use Apache as an example) was using both IP address to serve content, in the event of a DoS attack ...
0
votes
0answers
79 views

IIS 8.5 MinBytesPerSecond not working

I have an ASP.NET site running under IIS 8.5 on Windows 2012 R2. I'm trying to use the MinBytesPerSecond setting as part of a strategy to mitigate slow HTTP post attacks but can't seem to get IIS to ...
1
vote
1answer
45 views

Frequent SIGTERM Apache [closed]

I suspect sometings is going wrong in my webserver (maybe possible DoS attack). In fact I see a lot of such entries: [Sun Jul 19 10:36:21 2015] [error] [client 141.212.122.18] client sent HTTP/1.1 ...
0
votes
0answers
118 views

mod_evasive can't be installed: “undefined symbol: evasive24_module”

I wanted to protect my Apache/2.4.6 (CentOS) server in CentoOS 7 from DDOS attacks so after searching for some alternatives I found this page. They go through the installation of the modules evasive ...
0
votes
1answer
283 views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
0
votes
1answer
70 views

Google App Engine's blacklist not listing top IP addresses

I'm dealing with DOS attacks at the moment and could use a hand. In the past, App Engine would show the top IP Addresses hitting an instance on https://appengine.google.com/blacklist, but it's not ...
-3
votes
2answers
75 views

How to stop a cmd/ping flooder [closed]

I banned a guy from my site for breaking rules and he mailed me saying he will cmd flood/ping the site until I unban him. He's been bringing the site down for three days now. My site is with a ...
1
vote
1answer
80 views

Is it possible to bring down a network with DHCP discover?

When a DHCP server receives a DHCP discover message it broadcasts the offer across the entire network. If a malicious machine joined a network and somehow began spamming DHCP discover messages, would ...
3
votes
2answers
676 views

Weird Requests Being Sent to My Server [duplicate]

I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my ...
0
votes
1answer
215 views

How can I tell if a cisco router is dropping pings due to DOS suspicion or if it's experiencing packet loss?

We use a PRTG server that's connected to a cisco 6500, which feeds a large network of about 1200 switches and radios in a router-on-a-stick topology. In PRTG I'm able to set a 'ping burst' sensor on a ...
1
vote
4answers
352 views

How do I check if my VPS participated in a brute force or denial of service attack? [closed]

On VPS what logs do I have check and what type of information should I check for to find out if my server participated in a brute force or denial of service attack? I have the targeted IP address ...
1
vote
1answer
252 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
1
vote
1answer
44 views

Drupal application load troubleshooting

I'm receiving some sporadic high server load on a Drupal application (really high. 8 cores, load average of 50). The load is normally sitting between 5-10. The Drupal application sits behind a ...
0
votes
1answer
139 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
4
votes
1answer
3k views

What does enable DoS protection in Synology DSM 5 do?

If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked? The text reads "Denial-of-Service (DoS) protection helps to prevent ...
1
vote
1answer
1k views

Kali SYN Flood (Metasploit), not denying service

I have a server with apache2 installed. I tried to do a dos attack on the server by using kali linux syn flood attack, but i am still able to access the website on the server. msf auxiliary(synflood) ...
4
votes
1answer
236 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. ...
1
vote
2answers
653 views

trustwave pci scan: dns amplification denial of service, Bind 9.8.1-P1, doesn't seem like it

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service". Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: ...
0
votes
0answers
38 views

Intelligently filtering bogus query strings

A vBulletin site I maintain is on the wrong end of a DoS attack which is inexplicably routing through CloudFlare unimpeded by their DoS protection. The requests look like this: 1 /?ZZZZCQG=XJXAUD ...
-3
votes
1answer
666 views

Acunetix surfaces a Slow HTTP vulnerability, how do I protect against slowloris?

How to protect from slowloris ? I have installed mod_antiloris and mod_qos and acunetix still warn about slowloris. mod_antiloris and mod_qos are loaded Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 ...
1
vote
0answers
458 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
0
votes
3answers
459 views

How to protect server from simple DoS attack

Please note I am NOT asking how to protect server from DDoS. What I mean is that if someone runs siege -c 1000 www.example.com on his VPS. That will result in my server serving thousands of requests ...
0
votes
1answer
120 views

Abort any POST VERB operation in IIS

My site is getting DOS attack with POST VERB, my site is a static site and I am trying to stop any POST action on the home page. I had the URL Rewrite installed on my server, so I am trying to write ...
-3
votes
1answer
1k views

Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]

The site is a simple penny auction site. The site runs on: MySQL PHP At any given time: an auction can have 100 - 2000 concurrent users. each user has one single "long poll" running in the ...
1
vote
0answers
82 views

Cause for large number of duplicate web requests

I am seeing odd traffic to my web site. On occasion, probably a few times a day, I will get a flurry of requests for the same URI from the same IP address for several minutes, at rates from maybe one ...
0
votes
1answer
56 views

Under DoS, how to alter MediaWiki to reject quickly any editing and history requests for anonymous users

One of our MediaWiki - based projects seems under DoS attack - unusual number of anonymous users try to edit pages and view or edit history requests. While anonymous editing is disabled on that ...
1
vote
0answers
102 views

Preventing NFS Denial of Service

I have a NFS4 server running Ubuntu 10.04 Server, on an enterprise environment with 50+ clients. Overall, everything works fine, but from time to time, some client starts making +1000 NFS operations ...
0
votes
3answers
939 views

Is this a denial of service attack?

I have my kern.log flooded by these lines: Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 ...
12
votes
4answers
28k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
9
votes
2answers
2k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
0
votes
4answers
3k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
6
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
4
votes
2answers
344 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
1
vote
2answers
354 views

Block packets based on length

Can I block packets (Specifically UDP) that are > X length? I am getting attacked exclusively by UDP packets that are very large in size from a large number of IP Addresses. I have a legitimate use ...
1
vote
3answers
1k views

ESXi server under DoS attack, can I use SSH to determine where from? [duplicate]

My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host. I ...
0
votes
1answer
3k views

DNS Server being used for Amplified DNS Attack - ripe.net

We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the ...
-2
votes
4answers
478 views

Getting attacked, what do I do? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm getting millions of these requests in my Apache access log. How do I stop them? 173.59.227.11 - - [30/May/2012:18:23:45 -0400] ...
3
votes
1answer
223 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
5
votes
3answers
1k views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
1
vote
5answers
975 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
2
votes
3answers
1k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...