This question already has an answer here:

enter image description here

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 Mbps DoS attacks very easy.. no lag, no problem..

From time to time we were used to have big attacks but from only 1 or 2 IP at a time, so the CPU usage was always fine, until recently, we discovered a whole new level of DDoS attacks !

Some guy is flooding very small SYN packets, that are not exceeding 40 Mbps in total, but from thousand of IPs/botnets.. He is able to increase the CPU usage of the first COR up to its maximum, making the server almost down and not responding to RDP.. (The other 11 cors are empty, just chilling)

The TCP port that the attacker is targeting is a closed port, i think it's just the OS (Kernel in red) that's making all that mess.

I did some research, and (not sure) I think maybe the problem is something about IRQ balancing, like I need to balance that CPU usage between the other free cores..

Anyways, the big question is: Is it possible to fix this issue within the windows itself? How the hell can he kill my server with a 4% Network usage, when my server was able to stay alive even at 90% of the network usage before?! There must be a fix to this! Anyone know about balancing the 1st core to fix this? Please help with anything you have.

enter image description here

marked as duplicate by HopelessN00b Feb 18 '15 at 6:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • is this truly w2k8 not w2k8r2? – tony roth May 9 '13 at 16:34
  • i7's aren't exactly ideal server CPUs you know. – Chopper3 May 9 '13 at 16:39
  • @tonyroth Sorry it's a 2008 R2 (SP1), 64bit – Reacen May 9 '13 at 16:51
  • @Chopper3 It's a big hosting company that provides i7 as dedicated servers, why do you think it's bad ? – Reacen May 9 '13 at 16:52
  • @Reacen it's a desktop CPU, missing a lot of the RRAS features of the Xeon or Opteron chips, i7's are good value but I care too much about uptime to risk using one, but that's a budget thing I guess. – Chopper3 May 9 '13 at 21:40

A proper firewall in front of your Windows server will take care of that.

Failing that, you need to adjust your interrupt routing to distribute the interrupts to more cores. Here's an example of what it looks like before and after enabling said distribution (red line is a single core handling all the interrupts):


You can use RW Everything to modify the PCIe router configuration space if you know what to twiddle. Contact your server vendor to learn more.

Not the answer you're looking for? Browse other questions tagged or ask your own question.