Questions tagged [ddos]
A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
628
questions
0
votes
1
answer
114
views
Can't stop attack on nginx server
I'm currently struggling with my Digitalocean droplet (Ubuntu 22.10) which is under some sort of attack (maybe DDOS). The server hosts a containerized application that runs on nginx.
Every time I ...
0
votes
1
answer
48
views
I keep receiving login attempt to my server until it gets down
I have a Centos7 server and after years of correctly working, yesterday it started to being unreachable (The server apps I have there were not rechable, the SSH connection gave timeout, etc but the ...
0
votes
1
answer
72
views
What do these logs mean? Is someone attempting to hack into my server via ssh?
Today I woke up to a a very large number of logs for ssh, and I can only assume someone is trying to gain access to my linux server.
Here are the logs
-- Logs begin at Wed 2023-08-02 08:59:10 EEST, ...
1
vote
5
answers
175
views
Tips for coping with a surprisingly high rate of "botnet" sshd login failures?
I just set up 2 new Debian 12 VPS's at once.
One of them worked fine; the other, I appeared to have intermittent connectivity to. I even got as far as writing half of a support ticket, thinking it ...
0
votes
2
answers
175
views
Mitigation of a Slow Loris Attack (slow HTTP request DDoS)
I am being targeted by a slow loris attack for several weeks now (during the worst period of the year [black friday / cyber monday]).
This is an advanced DDoS attack where I get a lot of slow HTTP ...
0
votes
0
answers
64
views
How can nft block excessive 443 access?
I'm having a hard time configuring nft to fight floods on 443/TCP.
I gave up on iptables and module recent, and now I'm testing nft with its man page sample code, as a lab.
So, I'm sending all source ...
0
votes
0
answers
34
views
necesito configurar una regla de firewall en pfsense
chicos estoy haciendo una simulación de ataque DDoS utilizando máquinas virtuales (virtual box) ya logré hacer el ataque, sin embargo, necesito configurar pfsense para poder proteger mi servidor web ...
1
vote
1
answer
272
views
Is Apache mod_evasive really worthful
I read an article saying that apache mod_evasive is an old outdated module and does not real protection against Dos attack. After testing a scenario of load requests to a apache webpage it seems like ...
2
votes
0
answers
575
views
Can any help me to understand HAProxy DDoS attack protection configuration?
I'm using HAP on and off for a bit now and now I'm trying confgure DDoS protection per frontend, to block a connection for 5 mints, if it receives more than 200 requests per second from the same ...
0
votes
0
answers
28
views
Detect website attack by using azure sentinel serviceazure
I have a website which builds on AKS. I'm getting DDoS and other kind of attacks in website. In order to take prevention against such attacks, I'm planning to use the tool Azure Sentinel service.
...
1
vote
2
answers
62
views
.io auth. NS refuses UDP response to dnsviz.net – why shouldn’t I, too?
Seriously, say, I block (return, not drop of course) UDP :53 in to my authoritative nameserver. Resolvers will fall back to TCP and I won’t need any rate limiting against spoofed source IPs. Because ...
0
votes
0
answers
96
views
DDOS-Deflate won't update iptables
I am using DDoS-Deflate (https://github.com/jgmdev/ddos-deflate) in my CentOS 7 server. I installed it successfully. I use iptables as the firewall. The DDoS-Deflate bash script could detect abnormal ...
0
votes
0
answers
191
views
Nginx received DDOS attack
My website received DDOS attacks (confirmed).
I use Nginx as the reverse proxy server and have 3 WebApps (A,B,C) in the backend. The status is very strange. In DDOS status:
Nginx cannot return ...
0
votes
0
answers
377
views
How to serve both static and dynamic content via AWS cloudfront?
I have a site hosted on a digital ocean droplet which serves both static and dynamic content. The static content (e.g. /images, /js, /css, /fonts) is served from an s3 bucket with folders /images, /js,...
0
votes
1
answer
261
views
Block IPs without receiving traffic
I'm hosting on OVH Game dedicated server, the bandwitdth of this server is 1gbp/s, I'm receinving attack from other OVH Servers and they are saturating the bandwidth with 1gbp/s.
OVH doesn't filter ...
-1
votes
1
answer
181
views
My server is attacking other servers
I've been reached by OVH multiple times regarding a dedicated server which I bought from them, and they're saying that the server is attacking other hosts on their network.
The first time, the server ...
1
vote
2
answers
146
views
Can the bulk execution of "dig domain mx" on 5000 domains be considered an attack to the network?
I have a database containing a lot of invalid emails.
I want to remove all the emails whose domain does not have mx record.
So after I extracted the domain part I wrote a script to bulk check this for ...
0
votes
2
answers
671
views
How to detect an intranet SYN flood?
I got this problem: whenever I plug a Linux-server into the intranet, the whole network slows down and then die. Every ping/ssh connection between the intranet yields time out.
I unplugged it, then ...
0
votes
1
answer
27
views
All nights a network segment brings all network down
I have a medium-sized network: 45 devices with printers, a couple of DC and W10 desktops. Last week all network went down at 21:30 and, since that day, all network goes down unless I disconnect one ...
0
votes
1
answer
146
views
How to correctly set limits ports?
So im currently working on setting a simpel server up with a game server using port 30110 and 30120, but i clearly getting dossed like crazy, how is the best way to protect against this, like i have ...
0
votes
1
answer
221
views
Understanding dropping of packets to fight against an DDoS Attack
I always wondered how big tech companies could fight against DDoS Attacks reaching nearly 1tbps+. From my understanding traffic can't just disappear so even if I drop all e.g udp packets via iptables (...
0
votes
0
answers
26
views
How to repel an apache ddos attack [duplicate]
My nginx+apache+php server on ubuntu is under attack from a single IP address which causes apache to run as many processes as possible, which causes the server to crash. The ipi is single, and the ...
0
votes
1
answer
815
views
Apache on Debian : server flooded by a lot of 400 , how to protect from it?
My HTTPS server has been experiencing slowness for a few days, so I consulted the log file (the access.log, I use apache2). And I found out that my server is flooded by a lots of 400 :
If I change ...
1
vote
1
answer
1k
views
DDOS AWS API Gateway protection
I have publicly exposed API Gateway (HTTP). To authenticate you have to provide a valid JWT.
I want to secure this APIGW with Cloudfront + WAF. After reading docs I think that API Gateway endpoint is ...
0
votes
1
answer
128
views
How to get DDOS+WAF protection on IP/server (not domain)
I've used CloudFlare and it's great.
But in this specific case we control the server IP address but we don't own the domain so can't use CloudFlare unfortunately because the domain owner isn't ready ...
0
votes
1
answer
116
views
(Theoretical view) In a DDoS attack via docker, no correlation found between the amount of sent packets and the number of virtualized containers
I have been testing a DDoS attack in my local network via docker. Each image has loaded with an "evil" DDoS file.
I tested simultaneously several containers attacking at the same time. On ...
2
votes
1
answer
4k
views
Best way to enable DDoS protection on many individual GCP compute instances without load balancing?
I've been scouring through the Google Cloud Armor docs for information about DDoS protection of a GCP compute VM instance. From what I've found, Google Cloud Armor Managed Protection provides ...
0
votes
2
answers
41
views
Need to investigate why our server was DDOSing our host service provider
Hello everyone and hopefully somebody can give me a first step where I can begin investigating the reason to know why our Linux server appears to have attacked our service provider where the server is ...
0
votes
3
answers
288
views
PHP Maximum execution time exceeded - sign of attack?
We were facing a very high CPU load on our web server today. Our application was freezing and not reaction. We could reduce the load by setting the maximum execution time from 180 to 90 seconds.
...
0
votes
0
answers
305
views
How many pre-configured WAF rules do a small website needs? (GCP Cloud Armor)
I am looking at GCP Cloud Armor product. They charge $1 per-rule a month. There is this document with pre-configured rules: https://cloud.google.com/armor/docs/rule-tuning
Can you tell how much of it ...
1
vote
1
answer
946
views
How to hide Origin Server IP address from Reconnaissance tools
When it comes to web server security, I am a paranoid person.
On DigitalOcean, I'm running a server. They refer to it as a Droplet. Cloudflare is my DNS provider, and Cloudflare proxies and protects ...
1
vote
0
answers
272
views
named rate limiting - DDOS prevention
I'm wanting to implement some rate-limiting onto our named servers and am looking for some help on making sure the values are "sane". This is what I'm thinking...
rate-limit { errors-per-...
-1
votes
3
answers
1k
views
DDOS Attack to http server and iptables doesn't help (i have access_log) [duplicate]
Im under a DDOS attack that target http server, i try iptables and other measures but nothing seems to work. Here is part of access_log:
https://pastebin.com/6JFKmUi8
Lot of connections but iptables ...
0
votes
1
answer
111
views
How to restrict AWS access to queries from specific domain names?
Hello, this is my first post on Server Fault, so please feel free to edit/correct etiquette.
I am managing a server at work that we have hosted on AWS. Recently, it has fallen victim to a DDoS attack....
0
votes
0
answers
356
views
Fail2ban exited and didn't start back up
Today I faced a what seemed like a DDOS attack. My server provider warned me about excessive CPU usage (400% for over 6 hours) and I couldn't access any website, could not login via SSH either. Lish ...
18
votes
7
answers
5k
views
How can I protect SSH?
I check /var/log/secure and I have these logs:
Jul 9 13:02:56 localhost sshd[30624]: Invalid user admin from 223.196.172.1 port 37566
Jul 9 13:02:57 localhost sshd[30624]: Connection closed by ...
0
votes
1
answer
299
views
What does AWS EC2 DDOS protection shield throw when activated? HTTP(S) 503?
What does Amazon AWS EC2 DDOS protection shield throw when activated? HTTP(S) 503?
At which amount can this happen? 5000 - 10000 requests at "the same time"?
Is this public info and ...
-2
votes
1
answer
373
views
How can my users discover my upstream server IP though they only connect through load balancers?
I am managing a game server prone to DDoS. I have kept the upstream IP secret and only published the addresses of 100 load balancers forwarding traffic via iptables:
echo 'net.ipv4.ip_forward=1' >&...
1
vote
0
answers
27
views
Application role in preventing DDOS
I have an application that is being planned to be exposed to internet clients via a reverse proxy deployed in the DMZ, . I have recommended that the deployments use WAF/Cloudflare along with this to ...
1
vote
1
answer
1k
views
What happens when a post exceeds the limit of post_max_size?
If I send a payload of, for example, 10MB to an apache server, the limit being 2MB. How does the server know that the payload is 10MB? Doesn't he need to receive the file anyway, and check its size?
...
3
votes
1
answer
2k
views
How to prevent DDOS attack impact on Netlify? (downtime + bandwith usage/cost)
Situation:
React app that was initially running on a VPS
A few days ago, we were the target of a DDOS attack that took the site down.
During the attack, we decided to migrate to Netlify.
Once ...
0
votes
1
answer
450
views
I'm Under attacks even with mod_evasive mod_security and fail2ban [closed]
I have my centos fresh server with no problem, I have httpd, named but I get 150 failed logins per 10 minute. I also use Fail2Ban with maxretry 1 findtime 6h. and mod_evasive mod_security default ...
0
votes
2
answers
454
views
Can CDN caching prevent DoS attacks?
Let's say I use Cloudflare to cache my images, CSS, and JS files. Requests for the HTML content itself still hit my server and an attacker could use that to his advantage.
However, if I tell ...
0
votes
1
answer
85
views
How to prevent a lot of strange requests
I have and https site, which for one week receives a lot of strange requests just to main web site page (+ 2 js and 1 css files, but no images).
From nginx logs it looks like:
193.151.188.114 - - [02/...
0
votes
1
answer
640
views
UFW Weird ICMP log record - Pinging is blocked
In the log records below I have replace my eth MAC address with ETH_MAC_ADDRESS the IP of my server with MY_SERVER_IP and other IPs with STRANGE_IP plus a number to distingue.
Jan 29 15:11:48 cld ...
0
votes
0
answers
374
views
Extremely high incoming traffic on web server but no abnormalities in log files
Today we recorded extremely high incoming traffic (1 Gbps) on our Debian Webserver (green chart). On an average day it's at a maximum of about 20-30 Mbps. Firewall as well as fail2ban are configured ...
2
votes
0
answers
554
views
iptables performance during high-pps UDP attack
One of my servers is under constant UDP DDOS attack. ~500Mb/s and 700k PPS. I have a 10Gbit downlink so that is not the bottleneck.
In my IPTABLES I have created a 'whitelist' via ipset and dropping ...
0
votes
0
answers
108
views
How much DDOS mitigation one should expect from VPS provider?
We had a stateful WebRTC application which received some DDOS attacks. The server had 2gbits port, so any attack over 2gbits was able to make it unavailable. Afterwards we refactored the application ...
-5
votes
2
answers
156
views
Can I report malicious ip addresses for money?
My servers get attacks from thousands of ip addresses everyday. I have an idea. Can I report those malicious ip addresses, or use the resource to earn some money? How?
You may think these attacks are ...
0
votes
2
answers
153
views
DDOS protection without IP?
Is there any way to do DDOS protection without logging IP addresses? Any way to stop attacks without noting down IP addesses? This is because of data protection regulations