11
votes
3answers
4k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
1
vote
5answers
609 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
2
votes
1answer
330 views

Where can I find DoS attack simulator [closed]

I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc... Could someone please ...
0
votes
2answers
143 views

defend dos attack

my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second. Is there a way to defend this kind of attack? Is there a way to trace back to the ...
3
votes
3answers
6k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
1
vote
2answers
653 views

Protecting against Keep-Dead Denial of service

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash. I've looked through the logs but can't see ...
0
votes
1answer
260 views

DDOS Mitigation Services [duplicate]

Over the past week we have been a victim of two seperate ddos attacks varying in scale. The last one was very large and very hard to mitigate. We are looking at solutions from veriSign and Akamai ...
0
votes
3answers
351 views

Is it good to defense for DOS attacks with 2 request/sec?

Lots of example told me to defense with 5 or 4 request per second. Because usually a visitor clicking about in 1 or 2 links in one second, I think defense with 2 request per second is just fine. But ...
8
votes
8answers
420 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
1
vote
2answers
1k views

Best way to use large IP blacklist to deny access to a Windows 2008 web server?

Basically, I'm looking for a solution similar to the ones mentioned in a similar (but Linux-focussed thread) located here so that I can deny access to blacklisted IPs. I am specifically focussed on ...
18
votes
3answers
22k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
2
votes
6answers
567 views

Securing against DDoS [duplicate]

My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
1
vote
2answers
3k views

(D)DOS - tcpdump established connections analysis (too many established connections)

┬┐How can I debug this problem? (I've got full tcpdump captures) I have a TCP server into which many clients establish persistent connections. Normally all these clients behave, and I never reach ...
2
votes
5answers
612 views

DDoS attacks [duplicate]

How to prevent DDoS attacks on Windows/IIS servers ?
6
votes
4answers
835 views

Is account lockout a denial of service attack waiting to happen?

The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three).. This means that with the following net use \\targetmachine\c$ ...