Linked Questions
164 questions linked to/from I am under DDoS. What can I do?
9
votes
8
answers
22k
views
How to prevent a LOIC (DDOS) attack? [duplicate]
The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
questions
4
votes
6
answers
35k
views
How long do DDoS attacks last? [duplicate]
I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last?
Just trying to get an idea of how long we'll have to ...
- 391
2
votes
4
answers
6k
views
How can I stop a currently active DDoS attack? [duplicate]
My VPS is under a DDoS attack. I cannot access RDP, and I cannot take it offline, or access it in any way at all. What can I do?
They are not trying to bruteforce, just trying to stop access to the ...
- 206
6
votes
1
answer
42k
views
How can I detect a DDoS attack using pfSense so I can tell my ISP who to block? [duplicate]
Last week my network was hit by a DDoS attack which completely saturated our 100 MBps link to the internet and pretty much shut down all the sites and services we host.
I understand (from this ...
- 9,218
5
votes
3
answers
1k
views
100mb/s upgrade to 1gbps network - To Prevent DDOS [duplicate]
I have been under constant DDOS attack the last couple of weeks.
Now it seems my servers network is being flooded till it just doesn't have space anymore to receive and send normal packages.
I run ...
- 1,481
11
votes
6
answers
931
views
DDoS. Are we that helpless? [duplicate]
With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
- 243
0
votes
3
answers
18k
views
Block All UDP traffic (to prevent ddos) [duplicate]
I have been receiving countless ddos attacks the last couple of weeks. Just now I caught one while I was running iptraf. Normally 99.9% of the packets used on my server are TCP packages, and not UDP. ...
- 1,481
10
votes
2
answers
30k
views
Too many TIME_WAIT state connections! [duplicate]
I've been reading about this everywhere all day, and from what I've gathered, TIME_WAIT is a relatively harmless state. It's supposed to be harmless even when there's too many.
But if they're jumping ...
- 101
1
vote
4
answers
24k
views
How to prevent DDOS syn attack [duplicate]
I am running a site with 2 GB ram on centos. Using LAMP
Everyday for a few hours (about 3 to 4 hours) apache goes down. It takes too long to load a page and most of time it shows Request time out. ...
- 59
2
votes
2
answers
3k
views
DDoS Attacks on Game Servers [duplicate]
We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
- 660
5
votes
4
answers
4k
views
Mitigate DDoS attack with HAProxy [duplicate]
We were targeted earlier today by a DDoS attack. There was 20x as many connections as normal on our load balancer (HAProxy), and all the backend nodes continued to go down during this attack.
System ...
- 1,522
4
votes
6
answers
3k
views
How to survive anonymous DDOS attack? [duplicate]
Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional.
I read (basic theory) about dealing with normal DDOS ...
- 229
1
vote
1
answer
16k
views
DDOS Attack detection with netstat [duplicate]
I have a server, today load of my server over 20, i was found a command that detect alive connection to server for DDOS detection and reject IP.
netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | ...
- 11
6
votes
3
answers
5k
views
In Linux, does using route to blackhole an IP result in better performance than dropping in iptables? [duplicate]
During a DDOS attack, if we are finding IPs we want to block will we see better performance using a null route as opposed to iptables?
Null routing we would do something like:
ip route add blackhole ...
- 123
6
votes
1
answer
38k
views
Snort rules for syn flood / ddos? [duplicate]
Can someone provide me rules to detect following attack :
hping3 -S -p 80 --flood --rand-source [target]
I'm having problem with rules since packet comes from random source.
My current rules is :
...
- 183
3
votes
5
answers
4k
views
Apache DDoS Protection in router (pFsense) [duplicate]
I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
- 107
3
votes
5
answers
2k
views
Incoming DDoS Attack, It Looks Like An ICMP Attack, So What Do I block? [duplicate]
I recently have been getting hit by an attack that is very small around 70MBPS but causes TONS of upload...All signs point to ICMP. I realized in my firewall I have CSF firewall running on CentOS, ...
- 31
4
votes
2
answers
9k
views
How Can I Harden the TCP/IP Stack in Windows Server 2008? [duplicate]
I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks.
There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
- 6,157
1
vote
4
answers
2k
views
Identifying DOS attack [duplicate]
I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
- 121
2
votes
2
answers
13k
views
How do you prevent UDP-flood based DDOS attacks on a DNS server? [duplicate]
I'm studying networking at the moment, and it just occurred to me that one can easily forge DNS requests with fake IP addresses (since they use UDP). Since DNS relies on UDP for communication, couldn'...
Anne Nonimus
4
votes
3
answers
2k
views
Can't stop DDOS [duplicate]
I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it.
(1gbs is the maximum speed of the server.)
I've the following iptables rules:
...
- 231
4
votes
2
answers
2k
views
Can DDoS be stopped with BGP? [duplicate]
When I am experiencing DDoS @10Gbps, if I have BGP router with 10M table entries in it, can I perform search on the offensive network?
I would do this the way, that first I would remove routing to me ...
- 1,143
2
votes
3
answers
8k
views
Identifying DDOS Attacks on Windows 2008 Servers [duplicate]
I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down.
I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
- 6,157
3
votes
2
answers
5k
views
Allowing apache to write with iptables [duplicate]
Since to days ago I'm receiving DDOS atacks in my server. I've installed mod_evasive in apache and it works right! It writes the log and send the email with de IPs.
But there's a problem: Apache ...
0
votes
2
answers
4k
views
Defensing againt DDoS attack on Squid server [duplicate]
My Squid (3.1.20 on Ubuntu 13.04) is under DDoS attack (with about 1000 different IPs).
I'm using Basic Authentication on it and all of those requests are getting DENIED response but still they ...
- 147
2
votes
6
answers
605
views
Securing against DDoS [duplicate]
My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
- 999
1
vote
2
answers
3k
views
Varnish and Connection Flood (DoS - DDoS) [duplicate]
I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX (...
- 11
2
votes
4
answers
3k
views
Mitigating an http flood? [duplicate]
I have a ddos protection proxy in place to deal with SYN floods and such. But http floods are still getting through. For some reason their ddos proxy is not blocking any of the flood. So there are ...
- 257
1
vote
1
answer
3k
views
DROP vs REJECT DDoS [duplicate]
I asked somewhere else, and I got this response:
Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine ...
6
votes
5
answers
2k
views
DDoS Protection Services - are they good enough? [duplicate]
first of all, I understand that it's better to have DDoS protections on data center level. But our DC is not ready to provide good quality of protection. So we thinking about using some external DDoS ...
- 61
0
votes
3
answers
2k
views
DDoS - How to detect an attacker IP address [duplicate]
Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on ...
- 260
2
votes
4
answers
549
views
Apache getting DDoS [duplicate]
My apache server is currently getting DDoSed. It looks like all the traffic is referrals from the file server of a russian file sharing site. How can I block only the traffic which is coming from the ...
- 307
1
vote
1
answer
7k
views
pfSense + DDoS Protection [duplicate]
I run a gaming community on a colo with a 100Mbps port. I want to buy a very cheap 35 dollar server with the same 100Mbps port, and run pfSense to use as a hardware firewall. I'm dealing with a bunch ...
- 11
2
votes
4
answers
5k
views
How to protect Lighttpd from DOS attacks and flooding? [duplicate]
I have a problem with Lighttpd because someone started to use some Web downloader from very good connection and it blocked my whole website. Is there any way to protect Lighttpd from DDOS attacks and ...
- 1,125
2
votes
5
answers
756
views
6
votes
2
answers
2k
views
DDOS attack - How to prevent [duplicate]
Recently I read about Denial of Service attack on Amazon & PayPal. I am curious that how this is performed. These big companies must have huge servers, so DOS would require billions of bots to ...
- 375
-3
votes
2
answers
4k
views
Fail2Ban to block IPs that request the same URL repeatedly [duplicate]
Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds?
I'm not talking about a specific URL, but any random URL of the site that is being requested ...
- 185
1
vote
2
answers
7k
views
httpd high cpu usage slowing down server response [duplicate]
my client has a image sharing website with about 100.000 visitor per day
it has been slowed down considerably since this morning when i checked processes i've notice high cpu usage from http ....
...
- 187
2
votes
1
answer
5k
views
Best Practice for captcha based protection against D.O.S to Nginx Proxy [duplicate]
The idea is explained here
In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers.
If the number of request times within a certain period from ...
3
votes
3
answers
718
views
DDOS by several IPs with one connection [duplicate]
I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
- 278
0
votes
1
answer
5k
views
Too many open connections [duplicate]
I have a dedicated server with 32GB RAM. It works all fine till some punters came to ddos my server. I had really high uplink bandwidth usage (over 150Mbps). I looked at netstat with the following ...
0
votes
1
answer
5k
views
Iptables ratelimit UDP DOS attacks [duplicate]
Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way,
Attackers are ...
- 437
6
votes
1
answer
3k
views
DDoS and Heroku [duplicate]
I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do?
Yuri
1
vote
2
answers
3k
views
Using Free/Open BSD + pf as a DDoS filter [duplicate]
Is using Free/Open BSD + pf a workable option for filtering DDoS? Which of the two would perform better under heavy load? (SYN flood maxing a 1 gbit pipe)
Is this even an option to consider, or is a ...
- 593
-2
votes
2
answers
1k
views
DDoS Mitigation with round robin DNS? [duplicate]
Alright, so my friend and I are setting up a new website. We expect heavy DDoS attacks, so our plan is to use nginx to proxy from various cloud servers so that people can't find our actual server's IP....
- 2,453
1
vote
2
answers
960
views
Software vs. Hardware Appliance DDOS & Firewalls [duplicate]
I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables.
I'm evaluating my security options and was wondering how well ...
- 959
1
vote
3
answers
3k
views
iptables rule to stop DDOS [duplicate]
My server is undergoing a ddos attack with the traffic in my apache logs appearing like:
ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer"
ip ...
- 111
3
votes
3
answers
531
views
Anti-DDoS Question [duplicate]
Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea.
Although... I have a question... If our main ISP Backbone provider have ...
- 1,351
4
votes
2
answers
663
views
How to prevent DDoS attacks? [duplicate]
I am a creator of a flash game server. I use cloudflare for my site, however the game tcp server cant be protected by CloudFlare. For about 2 months some person DDoSes my game using direct ip. Every ...
- 55
2
votes
1
answer
3k
views
How to protect from spoofed SYN flood on a Linux machine? [duplicate]
I have a server (2 x E2620, 32 GB RAM, Debian 6 Linux us-fw 2.6.32-5-amd64 #1 SMP Mon Feb 25 00:26:11 UTC 2013 x86_64 GNU/Linux, 10G Intel Ethernet Card). It has an Nginx proxy server inside. Idea is ...
