Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms (1)

-2
votes
4answers
497 views

Getting attacked, what do I do? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm getting millions of these requests in my Apache access log. How do I stop them? 173.59.227.11 - - [30/May/2012:18:23:45 -0400] "...
3
votes
1answer
234 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
5
votes
3answers
1k views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
1
vote
5answers
1k views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
2
votes
3answers
2k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
9
votes
2answers
2k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
1
vote
2answers
5k views

Kernel Printk: xx message suppressed

Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
2answers
120 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
1answer
816 views

DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response

In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-5
votes
1answer
518 views

Wich module to defend my apache server? [closed]

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
3
votes
2answers
2k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...
2
votes
1answer
3k views

nginx: Prevent DoS by limiting worker processes/connections

If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable? Basically, I'm trying to secure my ...
2
votes
2answers
305 views

How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned by ...
3
votes
4answers
2k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a "?...
1
vote
1answer
463 views

Apache's built-in anti-dos mechanism by returning code 403?

In the process of learning more about how to survive simple DoS attack for my Apache server, I found some script to initiate attack on my own server and I notice that Apache returns error code 403 ...
3
votes
2answers
1k views

iptables rate-limit module problem

I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks). In my rules I have something like: /sbin/...
2
votes
1answer
573 views

Where can I find DoS attack simulator [closed]

I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc... Could someone please ...
1
vote
1answer
158 views

Is it normal to collapse VPS CPU with this script?

This is the script, it comes with mod_evasive: #!/usr/bin/perl #test.pl: small script to test mod_dosevasive's effectiveness use IO::Socket; use strict; for(0..100) { my($response); my($SOCKET)...
0
votes
2answers
149 views

defend dos attack

my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second. Is there a way to defend this kind of attack? Is there a way to trace back to the ...
0
votes
2answers
286 views

iptables logs but doesn't drop packets

I am trying to create some simple iptables DOS protection rules for my web server. I was doing testing on the following rules: iptables -N LOGDROP > /dev/null 2> /dev/null iptables -F LOGDROP ...
1
vote
1answer
91 views

Can't figure out this attack, getting botnets and something else

About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out. My site is not ...
2
votes
2answers
1k views

Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log

I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
3
votes
2answers
136 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a ...
5
votes
3answers
10k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
1
vote
3answers
192 views

Apache relaying to prevent DoS

I've been wondering, is there a technology that relays (slows down) responses to a given IP according to the rate It makes requests? E.g I have an apache server with a "heavy" API service that I want ...
1
vote
1answer
75 views

What is idea of web server attack on thinker/js/think.js?

My web server is getting a lot of GET request on thinker/js/think.js and thinker/showSimilarInfo.do. These requests obviously constitute a server attacks. What is point of these attacks? Also, ...
10
votes
2answers
4k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
5
votes
5answers
1k views

Ec2 Denial of Service: Securing cloud based website from DOS attack

How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy
0
votes
1answer
872 views

Windows Server 2008 Denial of Service Detection

We have a Windows 2008 server that hosts a file share in which a SQL server database is stored and accessed from another SQL server on the same network. Periodically, the database become inaccessible ...
2
votes
1answer
2k views

Protecting against UDP flood

One of my servers is being flooded with udp packets on random ports. 12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1 12:11:54.190447 IP 182.48.38.227.60173 > localhost....
2
votes
2answers
1k views

DDoS Attacks on Game Servers [duplicate]

We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
6
votes
3answers
427 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
0
votes
1answer
467 views

Detecting DOS attack

On one of our systems we see many requests that take 75 seconds. Under low traffic responses are ca 0.3 seconds. What I am wondering is if someone is trying to keep connections open in order to ...
1
vote
3answers
534 views

Fail2ban advice on banning IP's and HTTP

I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then ...
6
votes
2answers
1k views

Protecting against Keep-Dead Denial of service

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash. I've looked through the logs but can't see ...
1
vote
1answer
3k views

Logging Timeout'd Request in Apache 2.X

I am migrating some applications from Apache 1.3 to 2.2. We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 code,...
0
votes
2answers
263 views

CentOS Server keeps grinding to a halt, then comes back up

CentOS 5.2 LAMP server The server slows down to a point where no services are responding. After a few minutes, it comes back and is running well. The server keeps doing this cycle, what could be ...
0
votes
1answer
288 views

DDOS Mitigation Services [duplicate]

Over the past week we have been a victim of two seperate ddos attacks varying in scale. The last one was very large and very hard to mitigate. We are looking at solutions from veriSign and Akamai ...
0
votes
2answers
758 views

what should be limit to use for IPTABLE rate limiting for a webserver

I see on my webserver some logs as follows 203.252.157.98 - :25:02 "GET //phpmyadmin/ HTTP/1.1" 404 393 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro" 203.252.157.98 - :25:03 "GET //...
0
votes
1answer
2k views

How do I prevent against a DOS attack through Outlook Web Access?

If I configure an Active Directory Lockout Policy, then someone can use repeated bad login attempts to lock users out. How do I block an IP if enough bad login attempts come from it? Can I do this ...
3
votes
3answers
647 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
0
votes
3answers
469 views

Measure bandwidth by client IP in realtime

I have been recently attacked using DoS attack on random ports. I wasn't able to get the attackers IP and now I would like to find it. What tool can show me bandwidth (in Kbits/Mbits) used by each ...
7
votes
2answers
518 views

Detecting server abuse

Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. ...
2
votes
3answers
1k views

Apache mod status is showing ..reading

Recently my apache got DoS attack, it happened attacker flood SYN request to our apache, i know because at that time i have wireshark enabled. After the attack finished, i restart my apache and its ...
2
votes
2answers
476 views

How do you stop PINGs from causing a DOS on a Linux server?

Have a CentOS-5.x box that appears to be going down as a result of PINGs. If the server gets PINGs it stops replying to ssh/http connections. Appears iptable is one approach, but I want to make sure I'...
0
votes
4answers
759 views

Preventing Denial of Service Attacks

What's the most effecient way to prevent DoS attacks for game servers? Currently I do something like this: iptables -A INPUT -p udp --dport 27015 -m length --length 28 -j DROP Is it the best way?
3
votes
3answers
2k views

Strange DNS DOS attack — Endless Recursive Queries for <blank domain>

Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack. Three specific remote hosts have been bombarding two of our ...
1
vote
2answers
678 views

Ping size limit - FreeBSD

In the man page for FreeBSD ping: -s packetsize Specify the number of data bytes to be sent. The default is 56, which translates into 64 ICMP data bytes when combined with the 8 ...
0
votes
1answer
123 views

How can I recognize flooding? [closed]

how can I discover if my server is performing some illegal actions, like flooding?
3
votes
2answers
295 views

Is it possible to distinguish from “good” http requests and DoS attacks?

How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?