0
votes
2answers
815 views

IPTABLES for block sync flood over udp

I'm a victim of a sync flood attack over UDP port. This came from a lot of different IPs. The machine, a dedicated server, is an hlds game server, and the attacker overload the UDP ports, this cause a ...
1
vote
2answers
1k views

How to remove route with IP?

Used to ban some flood-bots with route add -host $ip reject But couple of 'good' IPs were banned as well. My question is stupid (but I've searched and found no good solution (all were large and/or ...
14
votes
3answers
50k views

“Possible SYN flooding” in log despite low number of SYN_RECV connections

Recently we had an apache server which was responding very slowly due to SYN flooding. The workaround for this was to enable tcp_syncookies (net.ipv4.tcp_syncookies=1 in /etc/sysctl.conf). I posted a ...
0
votes
1answer
743 views

Why does ping flooding a domain name freezes and not a direct ip address

I am wondering why, when ping flooding a domain, the ping flood freezes after a couple of seconds then continues and this freeze, unfreeze continues until i stop the ping flood. When i do the same ...
1
vote
2answers
1k views

Monitoring traffic on linux router for syn-flood

We have a linux server (Debian-Lenny) with solid-state drive, without hard disk classic. He's use as a router, so traffic is only for forward. We want to monitor connexions in able to find some ...
1
vote
2answers
385 views

Finding Evidence of a Denial of Service Attack (Linux)

We had a Gentoo Linux server (that was updated weekly or bi weekly) that higher ups claimed did a denial of service attack on the whole local network and brought it down. Are there any log files we ...