Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms (1)

0
votes
4answers
3k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
1
vote
5answers
1k views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
2
votes
3answers
2k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
5
votes
3answers
1k views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
6
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and "top"...
9
votes
2answers
2k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
0
votes
1answer
2k views

How do I prevent against a DOS attack through Outlook Web Access?

If I configure an Active Directory Lockout Policy, then someone can use repeated bad login attempts to lock users out. How do I block an IP if enough bad login attempts come from it? Can I do this ...
0
votes
3answers
1k views

Is this a denial of service attack?

I have my kern.log flooded by these lines: Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx....
-4
votes
1answer
2k views

Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]

The site is a simple penny auction site. The site runs on: MySQL PHP At any given time: an auction can have 100 - 2000 concurrent users. each user has one single "long poll" running in the ...
2
votes
3answers
1k views

Blocking IP addresses Load Balanced Cluster

We're using HAproxy as a front end load balancer / proxy and are looking for solutions to block random IP addresses from jamming the cluster. Is anyone familiar with a conf for HAProxy that can block ...
5
votes
3answers
10k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
1
vote
0answers
105 views

Preventing NFS Denial of Service

I have a NFS4 server running Ubuntu 10.04 Server, on an enterprise environment with 50+ clients. Overall, everything works fine, but from time to time, some client starts making +1000 NFS operations ...
20
votes
3answers
31k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from "...
2
votes
3answers
6k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
4
votes
2answers
354 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
1
vote
2answers
385 views

Block packets based on length

Can I block packets (Specifically UDP) that are > X length? I am getting attacked exclusively by UDP packets that are very large in size from a large number of IP Addresses. I have a legitimate use ...
1
vote
3answers
1k views

ESXi server under DoS attack, can I use SSH to determine where from? [duplicate]

My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host. I ...
1
vote
1answer
75 views

What is idea of web server attack on thinker/js/think.js?

My web server is getting a lot of GET request on thinker/js/think.js and thinker/showSimilarInfo.do. These requests obviously constitute a server attacks. What is point of these attacks? Also, ...
0
votes
1answer
3k views

DNS Server being used for Amplified DNS Attack - ripe.net

We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the ...
-2
votes
4answers
495 views

Getting attacked, what do I do? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm getting millions of these requests in my Apache access log. How do I stop them? 173.59.227.11 - - [30/May/2012:18:23:45 -0400] "...
9
votes
2answers
2k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
0
votes
3answers
469 views

Measure bandwidth by client IP in realtime

I have been recently attacked using DoS attack on random ports. I wasn't able to get the attackers IP and now I would like to find it. What tool can show me bandwidth (in Kbits/Mbits) used by each ...
1
vote
4answers
194 views

rhel-5.3->vm wordpress attack

i have a rhel 5.3 w/ few virtual machines and one of virtual pc runs cpu: intel quad 2.83 mem: 3.5G os: Linux 2.6.18-128.1.14.el5xen #1 SMP Mon Jun 1 16:09:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
1
vote
3answers
174 views
0
votes
4answers
2k views

Brainstorm: Flood/DoS/DDoS Attack prevention ideas

This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks. ...
0
votes
3answers
594 views

Is it good to defense for DOS attacks with 2 request/sec?

Lots of example told me to defense with 5 or 4 request per second. Because usually a visitor clicking about in 1 or 2 links in one second, I think defense with 2 request per second is just fine. But ...
1
vote
2answers
196 views

How are suspected DoS attacks handled by webservers?

I rent a server somewhere out in Canada or so that I'm using to host a website of mine. That website has close to 400,000 pages that I wanted to index today. For that, I wrote a crawler a while back (...
3
votes
3answers
2k views

Strange DNS DOS attack — Endless Recursive Queries for <blank domain>

Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack. Three specific remote hosts have been bombarding two of our ...
2
votes
2answers
473 views

How do you stop PINGs from causing a DOS on a Linux server?

Have a CentOS-5.x box that appears to be going down as a result of PINGs. If the server gets PINGs it stops replying to ssh/http connections. Appears iptable is one approach, but I want to make sure I'...
3
votes
3answers
644 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
0
votes
1answer
288 views

DDOS Mitigation Services [duplicate]

Over the past week we have been a victim of two seperate ddos attacks varying in scale. The last one was very large and very hard to mitigate. We are looking at solutions from veriSign and Akamai ...
0
votes
2answers
260 views

CentOS Server keeps grinding to a halt, then comes back up

CentOS 5.2 LAMP server The server slows down to a point where no services are responding. After a few minutes, it comes back and is running well. The server keeps doing this cycle, what could be ...
6
votes
3answers
427 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
2
votes
1answer
2k views

Protecting against UDP flood

One of my servers is being flooded with udp packets on random ports. 12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1 12:11:54.190447 IP 182.48.38.227.60173 > localhost....
1
vote
3answers
192 views

Apache relaying to prevent DoS

I've been wondering, is there a technology that relays (slows down) responses to a given IP according to the rate It makes requests? E.g I have an apache server with a "heavy" API service that I want ...
3
votes
2answers
136 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a ...
2
votes
2answers
1k views

Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log

I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
1
vote
1answer
91 views

Can't figure out this attack, getting botnets and something else

About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out. My site is not ...
0
votes
2answers
149 views

defend dos attack

my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second. Is there a way to defend this kind of attack? Is there a way to trace back to the ...
1
vote
1answer
158 views

Is it normal to collapse VPS CPU with this script?

This is the script, it comes with mod_evasive: #!/usr/bin/perl #test.pl: small script to test mod_dosevasive's effectiveness use IO::Socket; use strict; for(0..100) { my($response); my($SOCKET)...
2
votes
1answer
3k views

nginx: Prevent DoS by limiting worker processes/connections

If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable? Basically, I'm trying to secure my ...
3
votes
2answers
2k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...
1
vote
2answers
5k views

Kernel Printk: xx message suppressed

Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
2answers
120 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
1answer
807 views

DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response

In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-5
votes
1answer
516 views

Wich module to defend my apache server? [closed]

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
2
votes
2answers
303 views

How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned by ...
3
votes
4answers
2k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a "?...
1
vote
1answer
462 views

Apache's built-in anti-dos mechanism by returning code 403?

In the process of learning more about how to survive simple DoS attack for my Apache server, I found some script to initiate attack on my own server and I notice that Apache returns error code 403 ...