0

I have a hosted server running Asterisk PBX with the following specs: Debian 9 x86 64bit Linux, 2GB RAM, 2TB bandwidth, and 20 GB SSD storage.

For almost a day now, the server has been seemingly "offline". I cannot SSH into or connect to it using FileZilla (SFTP). Yet, I am getting normal ping responses:

Pinging domain.com [IP.AD.DR.ESS] with 32 bytes of data:
Reply from IP.AD.DR.ESS: bytes=32 time=28ms TTL=51
Reply from IP.AD.DR.ESS: bytes=32 time=30ms TTL=51
Reply from IP.AD.DR.ESS: bytes=32 time=26ms TTL=51
Reply from IP.AD.DR.ESS: bytes=32 time=27ms TTL=51

Ping statistics for IP.AD.DR.ESS:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 26ms, Maximum = 30ms, Average = 27ms

C:\Users\username>ping domain.com

Pinging domain.com [IP.AD.DR.ESS] with 32 bytes of data:
Reply from IP.AD.DR.ESS: bytes=32 time=27ms TTL=51
Reply from IP.AD.DR.ESS: bytes=32 time=30ms TTL=51
Reply from IP.AD.DR.ESS: bytes=32 time=30ms TTL=51
Reply from IP.AD.DR.ESS: bytes=32 time=43ms TTL=51

Ping statistics for IP.AD.DR.ESS:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 27ms, Maximum = 43ms, Average = 32ms

There was a brief period where, for a few minutes, I received "Response timed out", but within a few minutes it was reachable again and it has been like this ever since.

The ironic thing here is the average round trip times here are slightly better than they usually are when the server is operational!

Apart from a few minutes yesterday, none of my pings have been timed out.

I contacted my server admin, who has been DDoSed before and he said this was a DDoS and the only thing to do would be to wait. Yet, that doesn't add up to me. When I looked up how I could tell if it was, in fact, a DDoS attack, one thing I kept seeing was:

There are several clues that indicate an ongoing DDoS attack is happening — Loggly:

-The TTL (time to live) on a ping request times out

I asked my server admin to contact the server host and he refused, saying it was a DDoS attack and the only thing to do was wait for it to be over, that the server host could not do anything, and it would all just be a waste of time.

Personally, I was skeptical of that, especially with what I found just by pinging the server.

When I try SSHing, I simply don't get anything, then eventually Software caused connection timeout, and in FileZilla, I get Software caused connection abort, could not connect to server.

Is this really a possible DDoS attack? Or could something else be responsible for this, explaining both why the server is completely inaccessible and why pinging it seems to indicate the server is "healthy"?

Oh, also, all calls (Asterisk) to the server get dropped, so it can't be anything admin-specific, the server as a whole seems to be down, except for the ping replies.

2

The server is possibly under attack using a DoS at application level. Most OS's handle ping requests (ICMP packages) at kernel level. The server user-level might be exhausted from resources however the kernel level has some higher priorities which allows ping requests to be replied.

However, there is no certainty your server is under a (D)DoS attack.

To understand how a DDoS works and how this affects a server, network, ... A basic understanding of networking is needed. For example: knowledge OSI model and the TCP 3-way handshake is required.

Most DDoS attacks are using a layer 4 or a layer 7 approach.

Layer 4 attacks (Transport layer)

SYN flood

The attacker sends a massive amount of SYN messages to the victim from multiple locations or more likely via spoofed source addresses.

The target/victim server will allocate resources to handle this connection. Since no further action is taken by the attacker, the victim server will be in a state with loads of half-open connections. This results in a denial of service because the victim has no more resources to handle other legitimate connections.

UDP flood

The attacker sends any kind of (random) data. Latest years a technique called DNS amplification DDoS Attack has risen as an UDP flood attack.

This attack fills the complete bandwidth of the server and even possibly the upstream provider. Because the complete bandwidth is filled almost none/no legitimate traffic can reach the server.

Layer 7 attacks (Application layer)

These kind of attacks are application specific.

The goal of this kind of attack is to exhaust any kind of system resources. A process can become unresponsive because of high CPU usage but can also terminate itself because of the hard drive is complete full. Thus resulting in a denial of service.

  • Thanks eKKiM. It turns out my hosting provider actually closed their doors without ANY notice to any of its customers! Nonetheless I will keep all this in mind for when this happens again! – InterLinked Dec 20 '18 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.