Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms

2
votes
1answer
1k views

Protecting against UDP flood

One of my servers is being flooded with udp packets on random ports. 12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1 12:11:54.190447 IP 182.48.38.227.60173 > ...
2
votes
2answers
719 views

DDoS Attacks on Game Servers [duplicate]

We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
6
votes
3answers
381 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
0
votes
1answer
434 views

Detecting DOS attack

On one of our systems we see many requests that take 75 seconds. Under low traffic responses are ca 0.3 seconds. What I am wondering is if someone is trying to keep connections open in order to ...
1
vote
3answers
460 views

Fail2ban advice on banning IP's and HTTP

I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then ...
1
vote
2answers
653 views

Protecting against Keep-Dead Denial of service

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash. I've looked through the logs but can't see ...
1
vote
1answer
1k views

Logging Timeout'd Request in Apache 2.X

I am migrating some applications from Apache 1.3 to 2.2. We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 ...
0
votes
2answers
200 views

CentOS Server keeps grinding to a halt, then comes back up

CentOS 5.2 LAMP server The server slows down to a point where no services are responding. After a few minutes, it comes back and is running well. The server keeps doing this cycle, what could be ...
0
votes
1answer
260 views

DDOS Mitigation Services [duplicate]

Over the past week we have been a victim of two seperate ddos attacks varying in scale. The last one was very large and very hard to mitigate. We are looking at solutions from veriSign and Akamai ...
0
votes
2answers
647 views

what should be limit to use for IPTABLE rate limiting for a webserver

I see on my webserver some logs as follows 203.252.157.98 - :25:02 "GET //phpmyadmin/ HTTP/1.1" 404 393 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro" 203.252.157.98 - :25:03 "GET ...
0
votes
1answer
1k views

How do I prevent against a DOS attack through Outlook Web Access?

If I configure an Active Directory Lockout Policy, then someone can use repeated bad login attempts to lock users out. How do I block an IP if enough bad login attempts come from it? Can I do this ...
2
votes
3answers
517 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
0
votes
3answers
400 views

Measure bandwidth by client IP in realtime

I have been recently attacked using DoS attack on random ports. I wasn't able to get the attackers IP and now I would like to find it. What tool can show me bandwidth (in Kbits/Mbits) used by each ...
6
votes
2answers
359 views

Detecting server abuse

Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. ...
2
votes
3answers
818 views

Apache mod status is showing ..reading

Recently my apache got DoS attack, it happened attacker flood SYN request to our apache, i know because at that time i have wireshark enabled. After the attack finished, i restart my apache and its ...
2
votes
2answers
440 views

How do you stop PINGs from causing a DOS on a Linux server?

Have a CentOS-5.x box that appears to be going down as a result of PINGs. If the server gets PINGs it stops replying to ssh/http connections. Appears iptable is one approach, but I want to make sure ...
0
votes
4answers
687 views

Preventing Denial of Service Attacks

What's the most effecient way to prevent DoS attacks for game servers? Currently I do something like this: iptables -A INPUT -p udp --dport 27015 -m length --length 28 -j DROP Is it the best way?
3
votes
3answers
2k views

Strange DNS DOS attack — Endless Recursive Queries for <blank domain>

Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack. Three specific remote hosts have been bombarding two of our ...
1
vote
2answers
517 views

Ping size limit - FreeBSD

In the man page for FreeBSD ping: -s packetsize Specify the number of data bytes to be sent. The default is 56, which translates into 64 ICMP data bytes when combined with the 8 ...
0
votes
1answer
119 views

How can I recognize flooding? [closed]

how can I discover if my server is performing some illegal actions, like flooding?
3
votes
2answers
282 views

Is it possible to distinguish from “good” http requests and DoS attacks?

How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?
1
vote
2answers
173 views

How are suspected DoS attacks handled by webservers?

I rent a server somewhere out in Canada or so that I'm using to host a website of mine. That website has close to 400,000 pages that I wanted to index today. For that, I wrote a crawler a while back ...
1
vote
2answers
129 views

Has anyone experienced unintentional traffic overload due to clients' use of wget?

I am wondering if it is wise to indiscriminately block wget on servers that I maintain. Has anyone experienced unintentional traffic overload due to clients' use of wget?
5
votes
3answers
580 views

Is SYN flooding still a threat?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
3
votes
1answer
854 views

SYN flooding still a threat to servers?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
0
votes
3answers
351 views

Is it good to defense for DOS attacks with 2 request/sec?

Lots of example told me to defense with 5 or 4 request per second. Because usually a visitor clicking about in 1 or 2 links in one second, I think defense with 2 request per second is just fine. But ...
8
votes
8answers
420 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
1
vote
4answers
1k views

Brainstorm: Flood/DoS/DDoS Attack prevention ideas

This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks. ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
1
vote
2answers
1k views

Best way to use large IP blacklist to deny access to a Windows 2008 web server?

Basically, I'm looking for a solution similar to the ones mentioned in a similar (but Linux-focussed thread) located here so that I can deny access to blacklisted IPs. I am specifically focussed on ...
18
votes
3answers
22k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
1
vote
2answers
393 views

Finding Evidence of a Denial of Service Attack (Linux)

We had a Gentoo Linux server (that was updated weekly or bi weekly) that higher ups claimed did a denial of service attack on the whole local network and brought it down. Are there any log files we ...
1
vote
1answer
270 views

Repetitive / incessant hits to pages, blank referrer, non-malicious

I asked this question last week, and followed the debugging advice and now have additional information. I have an odd problem-- on a high traffic website (millions of visitors a month), every day we ...
2
votes
3answers
418 views

How to stop repetitive hits from same host to same URL?

I have an odd problem-- on a high traffic website (millions of visitors a month), every day we get about 20 or so situations where one host begins incessantly requesting the same page, over and over-- ...
1
vote
3answers
157 views

What is the best way to prevent somone abusing access to your site using scripts?

What is the best way to prevent someone abusing access to your site using scripts?
2
votes
6answers
567 views

Securing against DDoS [duplicate]

My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
1
vote
2answers
5k views

HTTP server, SYN flooding, and DoS attack questions

I am making an http server in c. It is in a pre-alpha stage but seemed to be stable enough to deploy on my server and run 4 minimal websites. It has been running seamlessly for two days until this ...
0
votes
5answers
1k views

MSSQL 2005 on port 1433 gets DOS from infected servers

I have a SQL Server 2005 server hosted outside my firewall at a data center. It is fully up-to-date on patches, etc. There's some old MSSQL worm (Slammer?) that STILL infects thousands of servers ...
1
vote
4answers
192 views

rhel-5.3->vm wordpress attack

i have a rhel 5.3 w/ few virtual machines and one of virtual pc runs cpu: intel quad 2.83 mem: 3.5G os: Linux 2.6.18-128.1.14.el5xen #1 SMP Mon Jun 1 16:09:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux ...
1
vote
2answers
3k views

(D)DOS - tcpdump established connections analysis (too many established connections)

¿How can I debug this problem? (I've got full tcpdump captures) I have a TCP server into which many clients establish persistent connections. Normally all these clients behave, and I never reach ...
2
votes
3answers
4k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
27
votes
6answers
16k views

How to best defend against a “slowloris” DOS attack against an Apache web server?

Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against ...
1
vote
4answers
201 views

AD Domain Controllers being Slammed

My Windows Server 2008 Domain Controllers are getting hundreds of log in attempts per minute. For the most part the IP addresses are not in the Event Log however the ones that do occasionally show up ...
2
votes
5answers
612 views

DDoS attacks [duplicate]

How to prevent DDoS attacks on Windows/IIS servers ?
1
vote
3answers
494 views

Do reports of packet flooding suggest a DOS attacK?

Our E1 connection is being closed by our firewall*. It happens intermittently every few days. I find log entries like this one around the same time as the dropout: Jun 2 09:53:35 sg580 kernel: ...
3
votes
3answers
164 views

What criteria do you use to determine if someone is hammering your server?

When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you ...
6
votes
4answers
835 views

Is account lockout a denial of service attack waiting to happen?

The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three).. This means that with the following net use \\targetmachine\c$ ...
9
votes
5answers
1k views

What are the best techniques for preventing denial of service attacks?

Currently I have been using (D)DoS-Deflate to manage such situations on numerous remote servers, along with Apache JMeter for load testing. Overall it has been working fairly well, although I'd like ...
2
votes
2answers
578 views

What does the arxiv.org anti-bot “search and destroy” actually do?

The lanl.arxiv.org math and scientific preprint service (formerly known as xxx.lanl.gov) has a strict policy against bots that ignore its robots.txt, Robots Beware. On that page, the have a link ...
2
votes
3answers
1k views

Blocking IP addresses Load Balanced Cluster

We're using HAproxy as a front end load balancer / proxy and are looking for solutions to block random IP addresses from jamming the cluster. Is anyone familiar with a conf for HAProxy that can block ...