The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
22 views

every minute - possible SYN flooding on port 80

On our Linux server from time to time we get well known SYN flood message: possible SYN flooding on port 80 this is probably not an attack because website traffic is big. However from some time ...
0
votes
0answers
48 views

GET /wpad.dat entries flooding my access_log

I have a small LAN of some 30 users in it with proxy auto configuration enabled and working. Two of them are requesting wpad.dat file too rapidly at a pace of 30 times per second. 10.1.14.246 - - ...
1
vote
0answers
46 views

Network flooded with LLC packet

Recently my network has been slow. From Tcpdump i found lot of frame with protocol LLC. A complete packet capture can been here tcpdump result Any hints on interpreting these packet?
0
votes
0answers
32 views

Floodlight :too many hosts displayed

I have 2 openvswitch switches to whom are attached 2 devices per switch leading to 4 overall devices. However, when I start floodlight web ui and go to "topology" section it displays me a lot of ...
0
votes
0answers
120 views

HP network discovery service flooding network with SLP / SRVLOC requests

I am having trouble with "HP Network discovery service" which I think is responsible for flooding my network with SLP/SRVLOC requests. This has happened on multiple occasions on different devices ...
0
votes
1answer
105 views

How to detect malicious script in my CentOS server? [duplicate]

I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it. Here's the detail my provider sent me: Where can I find the ...
0
votes
2answers
202 views

Protection against scrapping with nginx

This morning we had a crawler going nuts on our server hitting our site almost 100 times per second. We'd like to add a protection for this. I guess I'' have to use HttpLimitReqModule but I don't ...
0
votes
1answer
110 views

Stange stream of HTTP GET requests in apache logs, from amazon ec2 instances

I just had a look at my apache logs, and I see a lot of very similar requests: GET / HTTP/1.1 User-Agent: curl/7.24.0 (i386-redhat-linux-gnu) libcurl/7.24.0 \ NSS/3.13.5.0 zlib/1.2.5 libidn/1.18 ...
0
votes
1answer
491 views

How to protect from spoofed SYN flood on a Linux machine? [duplicate]

I have a server (2 x E2620, 32 GB RAM, Debian 6 Linux us-fw 2.6.32-5-amd64 #1 SMP Mon Feb 25 00:26:11 UTC 2013 x86_64 GNU/Linux, 10G Intel Ethernet Card). It has an Nginx proxy server inside. Idea is ...
1
vote
1answer
78 views

sudo passwd on Ubuntu 11.10 strange behavior. Have I been rooted?

I'm in a really strange situation. A few hours ago Rackspace issued a ticket saying there's a outbound flood originating from my server. Thinking the server might have been rooted with a rootkit I ...
0
votes
2answers
1k views

iptables rules for botnet (UDP flood) protection

I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in ...
2
votes
2answers
354 views

Network flooded with seemingly empty packets

Let me preface this with the fact that I'm just a web developer at my company with little networking knowledge. Earlier today there was a department that lost all of their network connections so I ...
0
votes
4answers
2k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
2
votes
1answer
1k views

Windows Server 2008: Limit UDP/TCP packets per IP or ban

How I can limit UDP/TCP packets per IP send to my host (or better PORT) per second or minute ? Would be nice to ban that IP for 12/24 hours or even for ever. I got Windows Server 2008 and I'm very ...
2
votes
1answer
467 views

Mitigate HTTP connect floods with HAproxy + Apache

Our infrastructure consists of load balancers running HAProxy and Apache, which forward traffic to our app servers running just Apache. The past few days, we've been seeing connection floods which the ...
0
votes
0answers
44 views

My site looks to be encoutering flooding, what should I do?

I'm recieving too many requests to my site that the CPU usage is always exceeding the limit and the site gets suspended. I tried blocking the IP range that most requests are coming from (a Chinese ...
1
vote
1answer
135 views

UDP flooding multiple servers [duplicate]

Possible Duplicate: What are the best techniques for preventing denial of service attacks? What do you suggest? Being UDP flooded as I write to multiple servers in different data centers ...
1
vote
1answer
449 views

Why is FunWebProducts flooding my server?

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible? 89.70.25.120 - - ...
0
votes
2answers
968 views

IPTABLES for block sync flood over udp

I'm a victim of a sync flood attack over UDP port. This came from a lot of different IPs. The machine, a dedicated server, is an hlds game server, and the attacker overload the UDP ports, this cause a ...
0
votes
2answers
685 views

Monitor incoming TCP/UDP flood attack and graph it

I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results. I have some VPSes that will perform ...
0
votes
4answers
722 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
2
votes
1answer
1k views

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
1
vote
2answers
1k views

How to remove route with IP?

Used to ban some flood-bots with route add -host $ip reject But couple of 'good' IPs were banned as well. My question is stupid (but I've searched and found no good solution (all were large and/or ...
0
votes
0answers
443 views

Prevent from UDP flood

How should I prevent from UDP flood attacks? My ISP don't wan't to block those attacks. So all I can do is block this using IPTABLES, I'm using Debian 5.0. I heard that if there is not maany IP ...
2
votes
2answers
2k views

Switch Floods Packets that should be Unicast

I work as a Network Admin in a big company. Lately we noticed an issue with our network infrastructure. Basically our network backend lies on a Catalyst as main L3 backend switch, and few Cisco Nexus ...
14
votes
3answers
55k views

“Possible SYN flooding” in log despite low number of SYN_RECV connections

Recently we had an apache server which was responding very slowly due to SYN flooding. The workaround for this was to enable tcp_syncookies (net.ipv4.tcp_syncookies=1 in /etc/sysctl.conf). I posted a ...
0
votes
1answer
119 views

How shared hosted web servers deal with spam (flood) attacks?

I want to know how shared webhosting or other types of it deal with Spam issues. Example: stop serving the website for a period of time, and how much is it? ...
1
vote
3answers
628 views

Causes of UDP Flood

This is part of a mail that I received The IP 69.89.6.235 is attacking our server at 94.23.204.191 and 87.98.168.239.80 with UDP flood. I have a newsletter scripts that I use to send newsletter to a ...
2
votes
1answer
1k views

Protecting against UDP flood

One of my servers is being flooded with udp packets on random ports. 12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1 12:11:54.190447 IP 182.48.38.227.60173 > ...
0
votes
1answer
792 views

Why does ping flooding a domain name freezes and not a direct ip address

I am wondering why, when ping flooding a domain, the ping flood freezes after a couple of seconds then continues and this freeze, unfreeze continues until i stop the ping flood. When i do the same ...
0
votes
1answer
360 views

SYN flooding, kernel error

My server (http://monitor.wingify.com/munin/visualwebsiteoptimizer.com/app.visualwebsiteoptimizer.com.html) recently had an outrage. One of the suspecious things I found was loads of SYN flooding ...
3
votes
4answers
2k views

Amazon EC2 bandwidth charges in case of unwanted incoming traffic(ddos/flood)?

What happens if my EC2 instance gets ddosed/flooded, which could potentially go up to tens of gigabytes an hour(and even more) of undesired incoming traffic, will i be charged for this traffic? My ...
1
vote
4answers
2k views

How can I prevent apache DoS flood?

I've configured a server running apache and a couple of days ago I noticed in the logs that there are bots running endless queries to the site. The logs show that those bots are running about 60 ...
0
votes
5answers
452 views

TCP attack invisible to netstat

we are hit by a strange attack, the attacker even emailed to challenge us. The output of "netstat -n" is just a few "ESTABLISHED" and "TIME_WAIT" typically, yet the server's website cannot be reached ...
27
votes
4answers
1k views

My server room has flooded

We recently went through a hurricane and our server room became flooded. Hooray for insurance. Anyway, I need to save as much data off one of the hard drives as possible. Yes, it was submerged for ...
0
votes
1answer
120 views

How can I recognize flooding? [closed]

how can I discover if my server is performing some illegal actions, like flooding?
1
vote
2answers
1k views

UDP Flood/DoS or What?

Basically I am receiving a lot of packets/data with random info on UDP protocol. Packet has header and then a lot of XXXXXXX in it's content. I assume it is UDP flood but it comes from different ...
0
votes
1answer
452 views

How does ospf control flooding?

What method is used by ospf protocol to prevent looping of flooded packets for link state advertisements? The packet header does not contain any timestamp. How do the routers recognize that it is the ...
1
vote
2answers
1k views

Monitoring traffic on linux router for syn-flood

We have a linux server (Debian-Lenny) with solid-state drive, without hard disk classic. He's use as a router, so traffic is only for forward. We want to monitor connexions in able to find some ...
1
vote
2answers
396 views

Finding Evidence of a Denial of Service Attack (Linux)

We had a Gentoo Linux server (that was updated weekly or bi weekly) that higher ups claimed did a denial of service attack on the whole local network and brought it down. Are there any log files we ...
0
votes
4answers
2k views

How to avoid floods like this?

Instead of describing what's happening I'll post a screenshot of Apache's server-status page: Screenshot It is a Nigerian IP. I'm having this problem for years now and I never found a viable ...
2
votes
4answers
3k views

How to protect Lighttpd from DOS attacks and flooding? [duplicate]

I have a problem with Lighttpd because someone started to use some Web downloader from very good connection and it blocked my whole website. Is there any way to protect Lighttpd from DDOS attacks and ...