Someone is DOSing my server. It is not a DDOS attack as there is only one server involved in this attack. I simply put following iptable rule to drop all the packets coming from the attacker:
iptables -I INPUT 1 -s IP_OF_ATTACKER -j DROP
This rule worked all fine. I could see his traffic coming to my server using iftop command. However, all my services were going smoothly even under DOS attack. He kept DOSING my server for 2-3 days but iptables rules worked great to drop his packets. However, today he ran his DOS attack again with same bandwidth but my server was dead. I captured/analyzed packets but iptables successfully dropped all the packets.
I also ran following command to see how much traffic was blocked by IP tables:
iptables -nvL --line-numbers
22G traffic was blocked for 2-3 days:
num pkts bytes target prot opt in out source destination 1 3203K 22G DROP all -- * * ATTACKER_IP 0.0.0.0/0
Only 3gb traffic was blocked. However, he DOSed our server for the whole day and there was more than 100GB traffic (IMHO).
num pkts bytes target prot opt in out source destination 1 707K 3553M DROP all -- * * ATTACKER_IP 0.0.0.0/0
Why the server was still down? What things could have been changed? Is there any other rule or protection that I can do to stop him? I already reported his IPs to hosting company but they take 7-8 days for investigation to shut his servers down.