Questions tagged [flooding]
The flooding tag has no usage guidance.
22
questions with no upvoted or accepted answers
4
votes
0
answers
1k
views
Fail2ban floods and slow response time
I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution.
I have an application that logs each connection on a custom log file.
When ...
4
votes
1
answer
846
views
Finding google unusual traffic
We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
- 231
2
votes
0
answers
3k
views
Protecting network from a broadcast storm
We have a flat office network tree built on a number of different ProCurve L2 and L3 GigE switches that spans some 300 ports. Today I found that one of the devices in the network for a short period of ...
- 2,326
1
vote
0
answers
577
views
how can i block/ban an ip after a number of rejects on a mail server?
I found several attempts to use my email server as relay. The helo command was not coming from a FQDN and therefor the request got rejected.
Is there a way to ban an IP address complelty after a ...
- 21
1
vote
1
answer
1k
views
Block SYN,ACK response with iptables
I have a virtual environment and Iam making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.
I realized that a countermeasure for this attack is to limit or block the responses to the ...
- 11
1
vote
0
answers
1k
views
SYNPROXY doesn't seem to be running
I have attempted to create iptables rules to prevent my server connections limit to be filled up with in-completed SYN packets for which no ACK packet is returned by the client (SYN flood attack).
I ...
- 212
1
vote
0
answers
397
views
ICMP DDoS, proper ACL?
We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
- 119
1
vote
0
answers
1k
views
How to block hping3 SYN ACK efficiently with iptables?
I'm trying to execute a TCP SYN flood on my Debian web server with nginx.
Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming.
iptables seem to work well ...
- 11
1
vote
0
answers
6k
views
ntopng: Host XXX.XXX.XXX.XXX is a flooder [NNN new flows in the last 3 sec]
I am exploring ntopng reports on my router and seeing, that one computer on my LAN is a flooder.
ntopng says Host XXX.XXX.XXX.XXX is a flooder [NNN new flows in the last 3 sec]
How to explore these ...
user102132
1
vote
0
answers
340
views
Network flooded with LLC packet
Recently my network has been slow. From Tcpdump i found lot of frame with protocol LLC. A complete packet capture can been here tcpdump result
Any hints on interpreting these packet?
- 11
0
votes
0
answers
150
views
Automatic TCP SYN - cookie activation
I am simulating a SYN flood attack on a Raspberry Pi 1 with KALI Linux (ARM) installed.
A similar message as mentioned in this post was printed after performing the attack: How to avoid syn cookies.
...
- 1
0
votes
2
answers
697
views
How to detect an intranet SYN flood?
I got this problem: whenever I plug a Linux-server into the intranet, the whole network slows down and then die. Every ping/ssh connection between the intranet yields time out.
I unplugged it, then ...
- 131
0
votes
0
answers
233
views
running snort and IGMP v2 flooding
I am not a network guru so please bear with me. I am running snort on a PLC (running rt-linux) along with an application that needs to communicate with another instance of the same application ...
- 101
0
votes
1
answer
734
views
opnsense disable anti flood
I've just installed OPNSense; it's working ok, I can have traffic in/out, but when trying to use a sustained stream such as rtmp, it stops after a few kB. If I disable the firewall, the stream goes on,...
- 169
0
votes
0
answers
75
views
Nginx flooded by IP address that's not going away
We are using nginx and seem flooded by an IP address that that's not going away even after putting it in firewall and usng tcpkill.
$ netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d:...
- 171
0
votes
0
answers
2k
views
Network timeouts with CentOS 7 server running in the same network (Syn-Flooding)
As described above, I'm having problems with my network during my CentOS 7 running.
When I first encountered problems with my network I tried to permanently run ping on the main router in the same ...
- 151
0
votes
1
answer
413
views
Fail2ban block on destination ip address
I have a server listening on multiple public ip addresses. When a certain situation occurs I want fail2ban to ban only on the specific ip address where the connection is attempted and not on the whole ...
- 532
0
votes
1
answer
344
views
How to prevent TCP network flood triggered by KVM VPS clients?
How to to protect nodes/ detect and block KVM VPS clients that TCP flood the network ?
I use SolusVM VPS management system.
Recently one abuser toke several VPSs and flood it the datacenter network. ...
- 77
0
votes
1
answer
778
views
Strange TCP Flood / Flood from Port 445
Good Evening.
Today I noticed a strange flood on a box that I am working with, here is a dump from tcpdump:
23:21:07.580917 IP (tos 0x0, ttl 64, id 5746, offset 0, flags [DF], proto TCP (6), length ...
0
votes
0
answers
705
views
GET /wpad.dat entries flooding my access_log
I have a small LAN of some 30 users in it with proxy auto configuration enabled and working.
Two of them are requesting wpad.dat file too rapidly at a pace of 30 times per second.
10.1.14.246 - - [...
- 328
0
votes
1
answer
142
views
How shared hosted web servers deal with spam (flood) attacks?
I want to know how shared webhosting or other types of it deal with Spam issues.
Example: stop serving the website for a period of time, and how much is it? ...
- 9
-1
votes
1
answer
323
views
Apache being hit by requests (cpu 100%)
recently we moved to a new host (DO) for one of my client after being on a shared account .
I was monitoring the cpu and it was always at 100% , knowing that the site dosnt get a lot of traffic , ...
- 101