Questions tagged [denial-of-service]
Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.
167
questions
34
votes
7
answers
35k
views
How to best defend against a "slowloris" DOS attack against an Apache web server?
Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against ...
27
votes
3
answers
15k
views
Why are NginX and Lighttpd not affected by Slowloris?
I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works.
What I don't understand is why Lighttpd and NginX are not affected (according to the ...
23
votes
3
answers
10k
views
Prioritise ssh logins (nice)
Is there a preferred way to set "nice" for sshd?
I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
22
votes
3
answers
47k
views
How do I block specific IPs and IP ranges in IIS7?
I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from "...
19
votes
7
answers
117k
views
Any reason not to enable DoS Defense in my router?
I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
10
votes
8
answers
480
views
Servers harrassed by individual on constantly changing IPs
We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
9
votes
3
answers
3k
views
What's the probable cause for extremely low inbound traffic and high outbound traffic?
Yesterday our Digital Ocean server encountered something that looked like an attack. The outbound traffic suddenly increased to 700Mbps, while the inbound traffic stayed at about 0.1Mbps, and didn't ...
9
votes
5
answers
2k
views
What are the best techniques for preventing denial of service attacks?
Currently I have been using (D)DoS-Deflate to manage such situations on numerous remote servers, along with Apache JMeter for load testing.
Overall it has been working fairly well, although I'd like ...
9
votes
2
answers
4k
views
Protecting against Keep-Dead Denial of service
i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash.
I've looked through the logs but can't see ...
9
votes
4
answers
1k
views
Stopping a DOS attack
One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
9
votes
2
answers
9k
views
What does enable DoS protection in Synology DSM 5 do?
If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked?
The text reads "Denial-of-Service (DoS) protection helps to prevent ...
9
votes
2
answers
4k
views
Linux: prevent outgoing TCP flood
I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
8
votes
4
answers
3k
views
Is account lockout a denial of service attack waiting to happen?
The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three)..
This means that with the following
net use \\targetmachine\c$ /user:...
8
votes
2
answers
739
views
Detecting server abuse
Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. ...
6
votes
4
answers
4k
views
How to stop a ICMP attack?
We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and "top"...
6
votes
3
answers
495
views
Somebody eating all our bandwidth, what should I do?
OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
6
votes
4
answers
19k
views
DOS attack "slow post" : How to prevent in IIS
I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability.
Have tried reducing the httpruntime ...
5
votes
3
answers
8k
views
What is a good way to detect DoS and DDoS in Fail2Ban?
I am configuring Fail2Ban on my Ubuntu web server to prevent it from being a victim of DoS / DDoS. I don't want to use Cloudflare because I have to route my DNS over and use their SSl cert.
...
5
votes
3
answers
2k
views
Excessive Outbound DNS Traffic
I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
5
votes
3
answers
1k
views
Is SYN flooding still a threat?
Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
5
votes
1
answer
618
views
Ban an IP when the server received an amount of data from it
What I need :
There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time.
What I ...
4
votes
3
answers
3k
views
Strange DNS DOS attack -- Endless Recursive Queries for <blank domain>
Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack.
Three specific remote hosts have been bombarding two of our ...
4
votes
5
answers
1k
views
Ec2 Denial of Service: Securing cloud based website from DOS attack
How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy
4
votes
1
answer
6k
views
Logging Timeout'd Request in Apache 2.X
I am migrating some applications from Apache 1.3 to 2.2.
We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 code,...
4
votes
2
answers
579
views
Tomcat Denial of Service due to large packets
I had asked this question on ITSecurity, but I felt this question is better placed here.
On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
3
votes
2
answers
953
views
Weird Requests Being Sent to My Server [duplicate]
I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my ...
3
votes
2
answers
179
views
In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]
I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena.
The service will consist of:
a website ...
3
votes
4
answers
3k
views
Tomcat denial of service
The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a "?...
3
votes
3
answers
2k
views
How to stop repetitive hits from same host to same URL?
I have an odd problem-- on a high traffic website (millions of visitors a month), every day we get about 20 or so situations where one host begins incessantly requesting the same page, over and over-- ...
3
votes
4
answers
5k
views
Fail2Ban on Apache Server to protect against DoS attacks?
I asked a question on the IT security StackExchange about protecting against DoS attacks.
One of the answers was to install Fail2Ban.
I talked to the people that administer the server and they told ...
3
votes
3
answers
718
views
DDOS by several IPs with one connection [duplicate]
I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
3
votes
2
answers
4k
views
Apache SSL Renogotiation (thc-ssl-dos)
Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled.
I have been checking a few servers and have the following questions;
First; renegotiations are disabled by ...
3
votes
3
answers
198
views
What criteria do you use to determine if someone is hammering your server?
When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you ...
3
votes
2
answers
411
views
Is it possible to distinguish from “good” http requests and DoS attacks?
How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?
3
votes
2
answers
2k
views
iptables rate-limit module problem
I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks).
In my rules I have something like:
/sbin/...
3
votes
1
answer
3k
views
Prevent DDOS Attack on GCP App Engine
I've launched my application on GCP App Engine with 8 micro-services.
I did an overload test with apache j-meter and it seems to scale well.
However this can also be used as a DOS attack on my ...
3
votes
1
answer
2k
views
SYN flooding still a threat to servers?
Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
3
votes
1
answer
400
views
Buffer-stuffing denial-of-service attack
I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
2
votes
2
answers
3k
views
DDoS Attacks on Game Servers [duplicate]
We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
2
votes
6
answers
605
views
Securing against DDoS [duplicate]
My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
2
votes
4
answers
249
views
AD Domain Controllers being Slammed
My Windows Server 2008 Domain Controllers are getting hundreds of log in attempts per minute. For the most part the IP addresses are not in the Event Log however the ones that do occasionally show up ...
2
votes
5
answers
755
views
DDoS attacks [duplicate]
How to prevent DDoS attacks on Windows/IIS servers ?
2
votes
1
answer
4k
views
nginx: Prevent DoS by limiting worker processes/connections
If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable?
Basically, I'm trying to secure my ...
2
votes
2
answers
7k
views
Kernel Printk: xx message suppressed
Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
1
answer
369
views
Is it possible to bring down a network with DHCP discover?
When a DHCP server receives a DHCP discover message it broadcasts the offer across the entire network. If a malicious machine joined a network and somehow began spamming DHCP discover messages, would ...
2
votes
3
answers
8k
views
Identifying DDOS Attacks on Windows 2008 Servers [duplicate]
I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down.
I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
2
votes
2
answers
757
views
What does the arxiv.org anti-bot "search and destroy" actually do?
The lanl.arxiv.org math and scientific preprint service (formerly known as xxx.lanl.gov) has a strict policy against bots that ignore its robots.txt, Robots Beware. On that page, the have a link ...
2
votes
1
answer
129
views
When an ISP is DDoSed, will its NOC have Internet access?
When an ISP is hit by a huge DDoS attack and its data plane is severely congested, will its Network Operations Center (NOC) have alternative Internet access?
I'm curious what would be the industry ...
2
votes
2
answers
137
views
Resolving a prolonged DDoS [duplicate]
I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
2
answers
337
views
How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned by the ...