Questions tagged [denial-of-service]

Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

Filter by
Sorted by
Tagged with
34 votes
7 answers
35k views

How to best defend against a "slowloris" DOS attack against an Apache web server?

Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against ...
KPWINC's user avatar
  • 11.5k
27 votes
3 answers
15k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
The Shurrican's user avatar
23 votes
3 answers
10k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
s29's user avatar
  • 348
22 votes
3 answers
47k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from "...
fordareh's user avatar
  • 660
19 votes
7 answers
117k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
ThomasCle's user avatar
  • 315
10 votes
8 answers
480 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
user avatar
9 votes
3 answers
3k views

What's the probable cause for extremely low inbound traffic and high outbound traffic?

Yesterday our Digital Ocean server encountered something that looked like an attack. The outbound traffic suddenly increased to 700Mbps, while the inbound traffic stayed at about 0.1Mbps, and didn't ...
Krzysztof Kraszewski's user avatar
9 votes
5 answers
2k views

What are the best techniques for preventing denial of service attacks?

Currently I have been using (D)DoS-Deflate to manage such situations on numerous remote servers, along with Apache JMeter for load testing. Overall it has been working fairly well, although I'd like ...
user avatar
9 votes
2 answers
4k views

Protecting against Keep-Dead Denial of service

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash. I've looked through the logs but can't see ...
user avatar
9 votes
4 answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
William's user avatar
  • 357
9 votes
2 answers
9k views

What does enable DoS protection in Synology DSM 5 do?

If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked? The text reads "Denial-of-Service (DoS) protection helps to prevent ...
tomsv's user avatar
  • 283
9 votes
2 answers
4k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
Willem's user avatar
  • 2,922
8 votes
4 answers
3k views

Is account lockout a denial of service attack waiting to happen?

The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three).. This means that with the following net use \\targetmachine\c$ /user:...
Bruce McLeod's user avatar
  • 1,748
8 votes
2 answers
739 views

Detecting server abuse

Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. ...
devicenull's user avatar
  • 5,632
6 votes
4 answers
4k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and "top"...
cumhur onat's user avatar
6 votes
3 answers
495 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
Auxiliary's user avatar
  • 163
6 votes
4 answers
19k views

DOS attack "slow post" : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
GordonBy's user avatar
  • 131
5 votes
3 answers
8k views

What is a good way to detect DoS and DDoS in Fail2Ban?

I am configuring Fail2Ban on my Ubuntu web server to prevent it from being a victim of DoS / DDoS. I don't want to use Cloudflare because I have to route my DNS over and use their SSl cert. ...
John Doe's user avatar
  • 365
5 votes
3 answers
2k views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
user avatar
5 votes
3 answers
1k views

Is SYN flooding still a threat?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
Rob's user avatar
  • 2,453
5 votes
1 answer
618 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. What I ...
user2284570's user avatar
4 votes
3 answers
3k views

Strange DNS DOS attack -- Endless Recursive Queries for <blank domain>

Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack. Three specific remote hosts have been bombarding two of our ...
evenmoreconfused's user avatar
4 votes
5 answers
1k views

Ec2 Denial of Service: Securing cloud based website from DOS attack

How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy
Quintin Par's user avatar
  • 4,443
4 votes
1 answer
6k views

Logging Timeout'd Request in Apache 2.X

I am migrating some applications from Apache 1.3 to 2.2. We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 code,...
Gant's user avatar
  • 2,595
4 votes
2 answers
579 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
sudhacker's user avatar
  • 143
3 votes
2 answers
953 views

Weird Requests Being Sent to My Server [duplicate]

I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my ...
nom's user avatar
  • 151
3 votes
2 answers
179 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a website ...
darkAsPitch's user avatar
  • 1,941
3 votes
4 answers
3k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a "?...
Mike L.'s user avatar
  • 131
3 votes
3 answers
2k views

How to stop repetitive hits from same host to same URL?

I have an odd problem-- on a high traffic website (millions of visitors a month), every day we get about 20 or so situations where one host begins incessantly requesting the same page, over and over-- ...
user avatar
3 votes
4 answers
5k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
Jeff's user avatar
  • 1,089
3 votes
3 answers
718 views

DDOS by several IPs with one connection [duplicate]

I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
Zach Smith's user avatar
3 votes
2 answers
4k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...
Baldrick's user avatar
  • 4,242
3 votes
3 answers
198 views

What criteria do you use to determine if someone is hammering your server?

When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you ...
username's user avatar
  • 4,785
3 votes
2 answers
411 views

Is it possible to distinguish from “good” http requests and DoS attacks?

How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?
mdgart's user avatar
  • 131
3 votes
2 answers
2k views

iptables rate-limit module problem

I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks). In my rules I have something like: /sbin/...
TopQ's user avatar
  • 93
3 votes
1 answer
3k views

Prevent DDOS Attack on GCP App Engine

I've launched my application on GCP App Engine with 8 micro-services. I did an overload test with apache j-meter and it seems to scale well. However this can also be used as a DOS attack on my ...
Elinoter99's user avatar
3 votes
1 answer
2k views

SYN flooding still a threat to servers?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
Rob's user avatar
  • 2,453
3 votes
1 answer
400 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
tylerl's user avatar
  • 15.1k
2 votes
2 answers
3k views

DDoS Attacks on Game Servers [duplicate]

We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
Aidan Knight's user avatar
2 votes
6 answers
605 views

Securing against DDoS [duplicate]

My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
gAMBOOKa's user avatar
  • 999
2 votes
4 answers
249 views

AD Domain Controllers being Slammed

My Windows Server 2008 Domain Controllers are getting hundreds of log in attempts per minute. For the most part the IP addresses are not in the Event Log however the ones that do occasionally show up ...
user avatar
2 votes
5 answers
755 views

DDoS attacks [duplicate]

How to prevent DDoS attacks on Windows/IIS servers ?
nitin's user avatar
  • 2,599
2 votes
1 answer
4k views

nginx: Prevent DoS by limiting worker processes/connections

If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable? Basically, I'm trying to secure my ...
Frank Vilea's user avatar
2 votes
2 answers
7k views

Kernel Printk: xx message suppressed

Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
Kevin's user avatar
  • 87
2 votes
1 answer
369 views

Is it possible to bring down a network with DHCP discover?

When a DHCP server receives a DHCP discover message it broadcasts the offer across the entire network. If a malicious machine joined a network and somehow began spamming DHCP discover messages, would ...
Oscar Robinson's user avatar
2 votes
3 answers
8k views

Identifying DDOS Attacks on Windows 2008 Servers [duplicate]

I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down. I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
Adam Brand's user avatar
  • 6,157
2 votes
2 answers
757 views

What does the arxiv.org anti-bot "search and destroy" actually do?

The lanl.arxiv.org math and scientific preprint service (formerly known as xxx.lanl.gov) has a strict policy against bots that ignore its robots.txt, Robots Beware. On that page, the have a link ...
Brian Campbell's user avatar
2 votes
1 answer
129 views

When an ISP is DDoSed, will its NOC have Internet access?

When an ISP is hit by a huge DDoS attack and its data plane is severely congested, will its Network Operations Center (NOC) have alternative Internet access? I'm curious what would be the industry ...
min's user avatar
  • 21
2 votes
2 answers
137 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
devnill's user avatar
  • 307
2 votes
2 answers
337 views

How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned by the ...
bobble14988's user avatar