Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms

27
votes
6answers
17k views

How to best defend against a “slowloris” DOS attack against an Apache web server?

Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against ...
19
votes
3answers
23k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
11
votes
4answers
8k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
9
votes
5answers
1k views

What are the best techniques for preventing denial of service attacks?

Currently I have been using (D)DoS-Deflate to manage such situations on numerous remote servers, along with Apache JMeter for load testing. Overall it has been working fairly well, although I'd like ...
8
votes
8answers
423 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
8
votes
2answers
1k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
7
votes
2answers
2k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
6
votes
3answers
389 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
6
votes
4answers
875 views

Is account lockout a denial of service attack waiting to happen?

The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three).. This means that with the following net use \\targetmachine\c$ ...
6
votes
2answers
1k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
6
votes
2answers
389 views

Detecting server abuse

Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. ...
5
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
5
votes
5answers
1k views

Ec2 Denial of Service: Securing cloud based website from DOS attack

How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy
5
votes
3answers
605 views

Is SYN flooding still a threat?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
4
votes
3answers
911 views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
4
votes
1answer
110 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. ...
4
votes
2answers
290 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
3
votes
2answers
132 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a ...
3
votes
3answers
2k views

Strange DNS DOS attack — Endless Recursive Queries for <blank domain>

Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack. Three specific remote hosts have been bombarding two of our ...
3
votes
3answers
164 views

What criteria do you use to determine if someone is hammering your server?

When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you ...
3
votes
2answers
284 views

Is it possible to distinguish from “good” http requests and DoS attacks?

How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?
3
votes
2answers
1k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...
3
votes
2answers
869 views

iptables rate-limit module problem

I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks). In my rules I have something like: ...
3
votes
3answers
7k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
3
votes
2answers
770 views

Protecting against Keep-Dead Denial of service

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash. I've looked through the logs but can't see ...
3
votes
1answer
901 views

SYN flooding still a threat to servers?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
3
votes
1answer
176 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
2
votes
2answers
854 views

DDoS Attacks on Game Servers [duplicate]

We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
2
votes
6answers
571 views

Securing against DDoS [duplicate]

My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
2
votes
4answers
1k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a ...
2
votes
3answers
445 views

How to stop repetitive hits from same host to same URL?

I have an odd problem-- on a high traffic website (millions of visitors a month), every day we get about 20 or so situations where one host begins incessantly requesting the same page, over and over-- ...
2
votes
5answers
619 views

DDoS attacks [duplicate]

How to prevent DDoS attacks on Windows/IIS servers ?
2
votes
1answer
2k views

nginx: Prevent DoS by limiting worker processes/connections

If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable? Basically, I'm trying to secure my ...
2
votes
3answers
560 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
2
votes
3answers
5k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
2
votes
2answers
592 views

What does the arxiv.org anti-bot “search and destroy” actually do?

The lanl.arxiv.org math and scientific preprint service (formerly known as xxx.lanl.gov) has a strict policy against bots that ignore its robots.txt, Robots Beware. On that page, the have a link ...
2
votes
2answers
116 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
2answers
204 views

How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned ...
2
votes
2answers
448 views

How do you stop PINGs from causing a DOS on a Linux server?

Have a CentOS-5.x box that appears to be going down as a result of PINGs. If the server gets PINGs it stops replying to ssh/http connections. Appears iptable is one approach, but I want to make sure ...
2
votes
3answers
1k views

Blocking IP addresses Load Balanced Cluster

We're using HAproxy as a front end load balancer / proxy and are looking for solutions to block random IP addresses from jamming the cluster. Is anyone familiar with a conf for HAProxy that can block ...
2
votes
2answers
793 views

Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log

I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
2
votes
1answer
1k views

Protecting against UDP flood

One of my servers is being flooded with udp packets on random ports. 12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1 12:11:54.190447 IP 182.48.38.227.60173 > ...
2
votes
1answer
387 views

Where can I find DoS attack simulator [closed]

I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc... Could someone please ...
2
votes
3answers
873 views

Apache mod status is showing ..reading

Recently my apache got DoS attack, it happened attacker flood SYN request to our apache, i know because at that time i have wireshark enabled. After the attack finished, i restart my apache and its ...
2
votes
1answer
695 views

What does enable DoS protection in Synology DSM 5 do?

If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked? The text reads "Denial-of-Service (DoS) protection helps to prevent ...
2
votes
1answer
545 views

DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response

In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
1
vote
4answers
203 views

AD Domain Controllers being Slammed

My Windows Server 2008 Domain Controllers are getting hundreds of log in attempts per minute. For the most part the IP addresses are not in the Event Log however the ones that do occasionally show up ...
1
vote
5answers
678 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
3answers
484 views

Fail2ban advice on banning IP's and HTTP

I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then ...