This is a known DDoS attack. The case is about a Windows server 2008 enterprise edition.

Under attack peak, server's CPU reaches 60%, 50% of memory is still free and half of network card is utilized so theoretically server still has enough resources for serving new requests but it cannot (request time-out error for new legitimate requests)

My questions:

  1. Since source IP addresses are not valid is it anyway to find the attacker IP address?
  2. How can prevent Request Time-out while there are still enough resources?
  3. Best known defense for such an attack (except hardware firewall)?

migrated from superuser.com Aug 3 '11 at 7:55

This question came from our site for computer enthusiasts and power users.

  • 1
    This is like the third question you've posted about the same situation. Why not take a breather and rethink your strategy, rather than throwing together a bunch of band-aids? – surfasb Aug 2 '11 at 21:43
  • Is this server directly connected to the Internet, and not behind a firewall? If so, what you really need to do is contact your ISP or hosting partner, and have them block it at their router. If you are trying to stop it with software, how is that really going to do anything? Your computer still needs to process it. – KCotreau Aug 2 '11 at 21:45
  • @surfasb: It took time for me to find out this is a bandwidth SYN spoof attack. In that question I learned how to use netstat command and after checking IP addresses I find it is a spoofing attack. Now this is a question about the solution for a known attack not finding the attack type. – Xaqron Aug 2 '11 at 22:02
  • @Xaqron: KCotreau nailed down what I was eluding to. It's clearly a situation you aren't equipped to deal with. It's best that you pick up the phone and talk to your ISP and have them filter it at their router. The ISP has a vested interest. A DDOS can also knock out service to any other customers on your router. – surfasb Aug 3 '11 at 18:15

Any good hacker will spoof the source in addition to using several different machines that may only be under his control due to their own compromised security. Reverse-tracing the IP address is almost always a fool's errand unless you've got significant chops as a hacker yourself.

I don't have a solution myself, but most software firewalls should allow rules that specific types of connections or connection attempts be dropped. Because it is still the software dealing with this, inspecting incoming packets and matching them against the rules, this will not drop the load completely off the server.

Which brings me to a final point: Why are you not using a hardware firewall in this setup? If this is a server touching the public internet it needs a seperate firewall device. Period.

UPDATE additional possibilities: Depending on the sort of agreement you have with your ISP, they may be willing and/or capable (for a price) to perform packet inspection/traffic shaping and firewall duties for you. Their systems are probably pretty capable of this. The problems would be that you'd never see if legitimate packets were being dropped. This is a lot like spam. The best DDoS attacks are the ones that look the most like legitimate traffic. And if you start losing customers or contacts due to overly aggressive firewall rules that you don't get direct control of (ie, rules on your ISP), it may hurt worse than the DDoS.

If you absolutely cannot use a hardware firewall you should at least give them a call.

  • Plus, Denial of service != CPU utilization nor NIC bandwidth. – surfasb Aug 2 '11 at 21:44
  • I'm not sure I get your point, surfasb. If he's only running a software firewall, any filtering requires both CPU and NIC utilization. What am I missing? – music2myear Aug 2 '11 at 21:53
  • Oh, I should of put that comment up top I guess. Basically, I was reiterating your point of a hardware firewall, because you can bring a machine to its knees without topping off the CPU or choking the bandwidth. – surfasb Aug 2 '11 at 21:56
  • @music2myear: This is not a long-time professional attack. I have had some before. When there are enough resources of all kind, it means there's still a software solution there. Hardware firewall does nothing more than processing requests and allowing fully hand-shacked connections. Since I have a huge network card, hardware firewall costs me a lot (common hardware firewalls become bottleneck in my case). I'll inform you here when I find the answer. – Xaqron Aug 2 '11 at 22:16

Sorry but software isn't a solution here. You are going to need hardware - and that might not be enough. Recently I was the webmaster at large internet retailer. We had dos attack on us and even though we had hardware in place it was still not enough to stop the flood. Our problem was it was filling up our bandwith pipe. even if you could get the bad traffic from the good, a lot of times its your bandwith that is going to be the bottleneck.

Also, what music2myear said is absolutely right, doubly right if it is indeed a windows machine.


On Linux, the tool you're looking for is SYN cookies. In Windows, it looks like SynAttackProtect ( http://www.symantec.com/connect/articles/hardening-tcpip-stack-syn-attacks for detailed info ). It looks like the Windows equivalent has a lot of similarities to SYN cookies, and the feature has been available since Win2k. The options may be different in 2k8, but at least this is a place to start.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.