I have a hosted server running Asterisk PBX with the following specs: Debian 9 x86 64bit Linux, 2GB RAM, 2TB bandwidth, and 20 GB SSD storage.
For almost a day now, the server has been seemingly "offline". I cannot SSH into or connect to it using FileZilla (SFTP). Yet, I am getting normal ping responses:
Pinging domain.com [IP.AD.DR.ESS] with 32 bytes of data: Reply from IP.AD.DR.ESS: bytes=32 time=28ms TTL=51 Reply from IP.AD.DR.ESS: bytes=32 time=30ms TTL=51 Reply from IP.AD.DR.ESS: bytes=32 time=26ms TTL=51 Reply from IP.AD.DR.ESS: bytes=32 time=27ms TTL=51 Ping statistics for IP.AD.DR.ESS: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 26ms, Maximum = 30ms, Average = 27ms C:\Users\username>ping domain.com Pinging domain.com [IP.AD.DR.ESS] with 32 bytes of data: Reply from IP.AD.DR.ESS: bytes=32 time=27ms TTL=51 Reply from IP.AD.DR.ESS: bytes=32 time=30ms TTL=51 Reply from IP.AD.DR.ESS: bytes=32 time=30ms TTL=51 Reply from IP.AD.DR.ESS: bytes=32 time=43ms TTL=51 Ping statistics for IP.AD.DR.ESS: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 27ms, Maximum = 43ms, Average = 32ms
There was a brief period where, for a few minutes, I received "Response timed out", but within a few minutes it was reachable again and it has been like this ever since.
The ironic thing here is the average round trip times here are slightly better than they usually are when the server is operational!
Apart from a few minutes yesterday, none of my pings have been timed out.
I contacted my server admin, who has been DDoSed before and he said this was a DDoS and the only thing to do would be to wait. Yet, that doesn't add up to me. When I looked up how I could tell if it was, in fact, a DDoS attack, one thing I kept seeing was:
There are several clues that indicate an ongoing DDoS attack is happening — Loggly:
-The TTL (time to live) on a ping request times out
I asked my server admin to contact the server host and he refused, saying it was a DDoS attack and the only thing to do was wait for it to be over, that the server host could not do anything, and it would all just be a waste of time.
Personally, I was skeptical of that, especially with what I found just by pinging the server.
When I try SSHing, I simply don't get anything, then eventually Software caused connection timeout, and in FileZilla, I get Software caused connection abort, could not connect to server.
Is this really a possible DDoS attack? Or could something else be responsible for this, explaining both why the server is completely inaccessible and why pinging it seems to indicate the server is "healthy"?
Oh, also, all calls (Asterisk) to the server get dropped, so it can't be anything admin-specific, the server as a whole seems to be down, except for the ping replies.