We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features.

It also runs a web interface for accesisng mails(Apache web server )

Recently our DC said that we are sending outbound DDOS attacks which touched upto 1.3Gbps as per their saying. They nulled the IP. After our request they re activated the IP again.

Now we are monitoring the server regulerly and seeing abnormal outbound traffcis at a avearge rate of 2mbps we dont sent that much emails) with peaks of upto 30mbps after each 30minutes period.(as per the data of New Relic Monitor)

The provider said that we might be running DDOS reflection attacks. The server logins are safe and authentication log says nothing abnormal

We dont have any DNS server running. Also NTP is running in client mode and it is secured.

nettop, iptraffic,nethogs show everything normal, only transmitted and recieved traffic summary in ifconfig says about the large amount of data sent.

Also we disabled NTP client on our IPMI as i read that supermicro IPMI is vulnerable to NTP reflection DDOS.

AT this point I am clueless and seeking help from experts here. Helps will be appreciated!

  • I'd definitely look at running tcpdump during one of the "busy" periods. That would give a first idea of what kind of traffic it was, which has got to be a first step in understanding how you're producing it - if you are. – MadHatter Mar 22 '14 at 14:36
  • I tried to do, so and unfortunately, I cant find anything except some normal SMTP connections and my own SSH Connections. If i again run tcpdump and paste the o/p here can you help me?? – user38427 Mar 22 '14 at 14:39
  • I'm sure someone will be able to take a useful look at it - but it won't help unless you do it during one of the apparent attacks (ie, when your ifconfig statistics are rapidly increasing). – MadHatter Mar 22 '14 at 14:41
  • Obviosly I will do that, I exactly know when ifconfig traffics increase, tried running nettop. iptraffic etc etc but they show normal traffic of about 100-200kbps when actually the traffic is around 30mbps!! – user38427 Mar 22 '14 at 14:44
  • Uhh, you can't always disable NTP on the IPMI cards. Sure the UI might let you do that, but don't actually rely on that to do anything. You'd need to actually check this isn't vulnerable. – devicenull Mar 22 '14 at 14:52

Upgrade your IPMI Firmware to a latest version. It looks like it's not your OS but vulnerable IPMI card.

You didn't tell us which model of IPMI/Chasis it is, but on the list of latest Super Micro firmwares there's no version 1.07, so it has to be newer one.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.