Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms (1)

1
vote
1answer
23 views

Nginx too many open files DDOS

Im having an issue with ddos at the moment. My web server is behind a reverse-proxy (cloudflare), which I know shouldn't be relied on with their free plan. Cloudflare is in under-attack-mode, which ...
0
votes
0answers
17 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
1
vote
2answers
68 views

How do I stop a simple DDOS attack?

There is a hacker who is mad at us, and has started a DDOS attack against us. I think he is a script-kiddie, using tools like DarkComet; the attack is probably simple. I host a server on my PC. The ...
-2
votes
3answers
58 views

Use two or more IP addresses to prevent DoS attacks [duplicate]

N00b question But say I had a dedicated server with two IP addresses, and the software (We'll just use Apache as an example) was using both IP address to serve content, in the event of a DoS attack ...
0
votes
0answers
22 views

IIS 8.5 MinBytesPerSecond not working

I have an ASP.NET site running under IIS 8.5 on Windows 2012 R2. I'm trying to use the MinBytesPerSecond setting as part of a strategy to mitigate slow HTTP post attacks but can't seem to get IIS to ...
1
vote
0answers
23 views

Frequent SIGTERM Apache

I suspect sometims is going wrong in my webserver (maybe possible DoS attack). In fact I see a lot of such entries: [Sun Jul 19 10:36:21 2015] [error] [client 141.212.122.18] client sent HTTP/1.1 ...
0
votes
0answers
58 views

mod_evasive can't be installed: “undefined symbol: evasive24_module”

I wanted to protect my Apache/2.4.6 (CentOS) server in CentoOS 7 from DDOS attacks so after searching for some alternatives I found this page. They go through the installation of the modules evasive ...
0
votes
1answer
122 views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
0
votes
1answer
31 views

app engine blacklist not listing top ip addresses

i'm dealing with DOS attacks atm and could use a hand. In the past, app engine would show the top IP Addresses hitting an instance on https://appengine.google.com/blacklist but it's not showing them ...
-3
votes
2answers
57 views

How to stop a cmd/ping flooder [closed]

I banned a guy from my site for breaking rules and he mailed me saying he will cmd flood/ping the site until I unban him. He's been bringing the site down for three days now. My site is with a ...
1
vote
1answer
51 views

Is it possible to bring down a network with DHCP discover?

When a DHCP server receives a DHCP discover message it broadcasts the offer across the entire network. If a malicious machine joined a network and somehow began spamming DHCP discover messages, would ...
3
votes
2answers
667 views

Weird Requests Being Sent to My Server [duplicate]

I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my ...
0
votes
1answer
94 views

How can I tell if a cisco router is dropping pings due to DOS suspicion or if it's experiencing packet loss?

We use a PRTG server that's connected to a cisco 6500, which feeds a large network of about 1200 switches and radios in a router-on-a-stick topology. In PRTG I'm able to set a 'ping burst' sensor on a ...
1
vote
4answers
219 views

How do I check if my VPS participated in a brute force or denial of service attack? [closed]

On VPS what logs do I have check and what type of information should I check for to find out if my server participated in a brute force or denial of service attack? I have the targeted IP address ...
1
vote
1answer
96 views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...
1
vote
1answer
42 views

Drupal application load troubleshooting

I'm receiving some sporadic high server load on a Drupal application (really high. 8 cores, load average of 50). The load is normally sitting between 5-10. The Drupal application sits behind a ...
0
votes
1answer
94 views

Mitigate DDos on Windows box [duplicate]

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. I am ...
4
votes
1answer
2k views

What does enable DoS protection in Synology DSM 5 do?

If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked? The text reads "Denial-of-Service (DoS) protection helps to prevent ...
1
vote
1answer
1k views

Kali SYN Flood (Metasploit), not denying service

I have a server with apache2 installed. I tried to do a dos attack on the server by using kali linux syn flood attack, but i am still able to access the website on the server. msf auxiliary(synflood) ...
4
votes
1answer
224 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. ...
1
vote
2answers
561 views

trustwave pci scan: dns amplification denial of service, Bind 9.8.1-P1, doesn't seem like it

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service". Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: ...
0
votes
0answers
35 views

Intelligently filtering bogus query strings

A vBulletin site I maintain is on the wrong end of a DoS attack which is inexplicably routing through CloudFlare unimpeded by their DoS protection. The requests look like this: 1 /?ZZZZCQG=XJXAUD ...
-3
votes
1answer
576 views

Acunetix surfaces a Slow HTTP vulnerability, how do I protect against slowloris?

How to protect from slowloris ? I have installed mod_antiloris and mod_qos and acunetix still warn about slowloris. mod_antiloris and mod_qos are loaded Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 ...
1
vote
0answers
362 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
0
votes
3answers
367 views

How to protect server from simple DoS attack

Please note I am NOT asking how to protect server from DDoS. What I mean is that if someone runs siege -c 1000 www.example.com on his VPS. That will result in my server serving thousands of requests ...
0
votes
1answer
95 views

Abort any POST VERB operation in IIS

My site is getting DOS attack with POST VERB, my site is a static site and I am trying to stop any POST action on the home page. I had the URL Rewrite installed on my server, so I am trying to write ...
-2
votes
1answer
1k views

Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]

The site is a simple penny auction site. The site runs on: MySQL PHP At any given time: an auction can have 100 - 2000 concurrent users. each user has one single "long poll" running in the ...
1
vote
0answers
76 views

Cause for large number of duplicate web requests

I am seeing odd traffic to my web site. On occasion, probably a few times a day, I will get a flurry of requests for the same URI from the same IP address for several minutes, at rates from maybe one ...
0
votes
1answer
55 views

Under DoS, how to alter MediaWiki to reject quickly any editing and history requests for anonymous users

One of our MediaWiki - based projects seems under DoS attack - unusual number of anonymous users try to edit pages and view or edit history requests. While anonymous editing is disabled on that ...
1
vote
0answers
94 views

Preventing NFS Denial of Service

I have a NFS4 server running Ubuntu 10.04 Server, on an enterprise environment with 50+ clients. Overall, everything works fine, but from time to time, some client starts making +1000 NFS operations ...
0
votes
3answers
774 views

Is this a denial of service attack?

I have my kern.log flooded by these lines: Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 ...
11
votes
4answers
19k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
8
votes
2answers
2k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
0
votes
4answers
2k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
6
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
4
votes
2answers
324 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
1
vote
2answers
315 views

Block packets based on length

Can I block packets (Specifically UDP) that are > X length? I am getting attacked exclusively by UDP packets that are very large in size from a large number of IP Addresses. I have a legitimate use ...
1
vote
3answers
959 views

ESXi server under DoS attack, can I use SSH to determine where from? [duplicate]

My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host. I ...
0
votes
1answer
3k views

DNS Server being used for Amplified DNS Attack - ripe.net

We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the ...
-2
votes
4answers
458 views

Getting attacked, what do I do? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm getting millions of these requests in my Apache access log. How do I stop them? 173.59.227.11 - - [30/May/2012:18:23:45 -0400] ...
3
votes
1answer
206 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
5
votes
3answers
1k views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
1
vote
5answers
819 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
3answers
1k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
6
votes
2answers
1k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
1
vote
2answers
4k views

Kernel Printk: xx message suppressed

Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
2answers
117 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
1answer
693 views

DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response

In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-4
votes
1answer
419 views

Wich module to defend my apache server? [closed]

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
3
votes
2answers
2k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...