Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ddos]

A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

-1
votes
1answer
30 views

How to interpret Firewall logs?

Today I have found few failed auth attempts on ssh server and I decided to check all logs for suspicious activity. Here are my router firewall logs (small part of it): Dec 12 21:24:12 kernel: DROP IN=...
0
votes
2answers
55 views

huge traffic from different IPs on my ubuntu vps

I've change my vps recently, vps provider told me that he has backed up my VPS hdd from previous server and deployed it on the new server and changed just my ip, but now I have a huge traffic and ...
0
votes
1answer
48 views

Can this be consider as a ddos (logfiles)

our server crashed yesterday for the 1 time after one whole year. So i checked the logs and find some strange things. There is one ip that make about 450 individual site-requests in a 12 min period of ...
-2
votes
0answers
27 views

how to connect to dynamic IP VPN by requesting current IP from second server

I'm looking to obscure my VPN server address through authentication with a second server. The setup would be the following: A VPN server with a dynamic IP address An Amazon EC2 instance with Amazon ...
0
votes
0answers
19 views

Iptables block doesn't work [duplicate]

Someone doing DOS attack on our server. "UDP (60 bytes) from 207.180.196.234:60797 to x.x.x.x:9987 on eth0 " Targeting 9987 port ( Our TeamSpeak3 server port ) We are trying everything what we can ...
1
vote
1answer
27 views

Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)

This is a two part question, really. Keep in mind that I am a developer not a system admin, but being the only employee in the company, I wear ALL the hats. I have deployed my server with two ...
1
vote
2answers
42 views

What is a good way to detect DoS and DDoS in Fail2Ban?

I am configuring Fail2Ban on my Ubuntu web server to prevent it from being a victim of DoS / DDoS. I don't want to use Cloudflare because I have to route my DNS over and use their SSl cert. ...
1
vote
1answer
52 views

Azure Ubuntu VM: Is a connection to 168.63.129.16:80 mandatory for Basic DDOS protection?

Yesterday I noticed some suspicous activity when running netstat | grep http on my Azure Ubuntu VM: There were over 60 lines like this: tcp 0 0 ser:http hosted-by.blazing:...
1
vote
0answers
34 views

Will More vCPU's and RAM Help Protect Against Some Smaller Scale DDoS Attacks?

Obviously having more vCPU's (virtual CPU's) and more RAM by them self won't be able to alone help stop and/or prevent a DDoS attack, but let's say after a DDoS attack is finished and/or slowing down ...
0
votes
1answer
112 views

Slow SYN flood: preventing SYN amplification?

a (linux) webserver I administer (on a VPS) for a low volume website has just been subjected to about 5 SYN requests/second on port 80, with no other traffic coming from the remote host. It was more ...
0
votes
1answer
57 views

Configuring postfix or other software to route mail through Cloudflare or other ddos protection?

So I'm looking to set up my own mail server with postfix, but I've currently routed my web server through CloudFlare. Is there a way to route all outbound emails through some sort of proxy or ddos ...
1
vote
1answer
74 views

DDoS Mitigation on Google Cloud Platform

If I Block IP Addresses in Google Cloud Platform and I get DDoS Attack from those blocked IP Addresses, will Google Cloud Handle The Attack Or Null Route My Google VM IP?
1
vote
2answers
41 views

iPhone OS 11_3 http connection flood

I have been trying to limit max TCP connections to port 80 of my server coming from the same IP. I have used iptables for this task: -A INPUT -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED -m ...
0
votes
1answer
44 views

Fallout from apparent dos attack - httpd trying to contact attacker [duplicate]

I have a server running multiple web hosts (all internally managed) which was the subject of what looked like a dos attack last night. I blocked the attacking IP in IPTABLES for both input and output ...
0
votes
0answers
62 views

nginx req_limit not triggering fail2ban event (cloudflare api)

like the topic states im trying to setup fail2ban for nginx but im having some problems. I want to watch the req_limit error in the nginx error.log and ban the ip on cloudflare via fail2ban, so no ...
0
votes
0answers
32 views

hetrix bot high requests detected in incapsula firewall

I have been monitoring real time results through incapsula, and have noticed that there is a rather large number of requests coming from a hetrix bot. Here is a image, and this is just one ip of ...
0
votes
1answer
83 views

DDOS attack protection HAPROXY SSL

I'm trying to protect my server from DDOS attacks, my server always have a redirection to the SSL/HTTPS protocol. but I'm using the next configuration and it's not working frontend http-in bind *...
0
votes
1answer
102 views

how to stop dns amplification attack from my server

We have dedicated server with centos7. For last 3 days we are receiving Abuse reports that saying 'we detected the following DoS attack with DNS related pattern.' And the source is our server. How ...
1
vote
1answer
118 views

coping with DNS DDOS attack

I have been getting lots of DNS requests for a while, but it would come and go sporadically. Now, it has developed into a DDOS, with several IPs sending traffic at the same time. It was saturating ...
2
votes
1answer
97 views

Active Directory is being attacked remotely

Thanks for clicking, I'm having an issue with our server where our Active Directory is being abused by random external servers. From what I can gather, our server is the victim of an LDAP forwarding ...
0
votes
1answer
313 views

How should I test google cloud's DDOS protection?

I've an application deployed on a Google compute engine, which is being load balanced using Google's HTTPS Load Balancer. And according to this article , With global HTTP(S) load balancing, the ...
0
votes
2answers
178 views

Using UFW to completely block internet provider [duplicate]

I am facing a DDOS attack from a few hundred IP addresses, all of them coming from various cities in India and have the same organization: "................ for GPRS Service". (I'm not mentioning the ...
0
votes
0answers
54 views

Secure iptables logging against DDoS

My server is blocking all IP addresses except Slovakia and Czech Republic, and I would like to log all other countries and then drop it. So my rules looks like this: iptables -A INPUT -m geoip ! --...
0
votes
0answers
80 views

What are HAProxy defaults for DDoS protections in Openshift 3.6?

Openshift documentation details how to configure HAProxy to prevent DDoS attacks, but the docs make no mention of default values. If these are not set explicitly, what are the defaults (if any)? ...
-1
votes
1answer
143 views

Configure an anti-DDOS on a server with iptables and/or VPN by using OVH's anti-DDOS [closed]

I am hosting my server on my computer at home and I would like to install an anti-DDOS system by using the anti-DDOS managed by OVH. I am actually redirecting my domain name to the IP of one of my OVH ...
1
vote
1answer
39 views

How to check if my machine is an amplifier for DRDoS?

My machine has been identified as amplifier for DRDoS attack. How can I trace how my machine has been used to do this and remove the software used? I tried to check machine's system log but I can't ...
1
vote
1answer
294 views

Is a DDoS possible if the port being attacked is closed?

Let's assume a hypothetical situation in which port 50000 of a machine was being bombarded with UDP packets. However, port 50000 on said machine isn't actually open (i.e. the machine is not listening ...
0
votes
0answers
8 views

centos - malware repeat a command and make high CPU usage [duplicate]

my Centos server fail on Ddos attack and i fix it by blocking some IP but now always i have a high CPU usage. htop command show me a simple command like "ls", "cd", "gnome-terminal" and etc.. make ...
0
votes
1answer
489 views

NGINX for TCP DDOS Protection

I require a TCP reverse proxy to protect my server's IP. I need something like this which works fine https://xhosts.uk/ddosprotection or https://www.hostsavor.com/proxies I was wondering if I could ...
0
votes
2answers
249 views

Can TCP Keepalive technique be used to prevent DDOS?

I am learning about DDOS and the techniques to mitigate it. TCP Keepalive is used to check if the other host is still up and if the host does not acknowledge the tcp keep alive message, the connection ...
0
votes
1answer
297 views

How can I protect against Slowloris on a NGINX server? [duplicate]

Well, I recently discovered that my site(s) were vunerable to the Slowloris attack. A few seconds in after testing the attack on my server just to verify it was Slowloris that was causing the issue, ...
0
votes
0answers
26 views

DDOS attack on cloudflare attached server

So I have like 4 Digital Ocean droplets and they all are attached to DNS through cloudflare. The problem is they all are being attackers in different times of month by millions of IPs and some of them ...
-5
votes
2answers
60 views

Trying to understand something [closed]

So I'm trying to figure something out, if I receive UDP traffic to my server from another server I can't really block it, like the iptables it's just blocking the traffic to being processed, but I ...
0
votes
0answers
250 views

IIS & NGINX DDOS Protection

I have a Windows 2012 R2 server with IIS currently set up on it and I was wondering what my options were to make this DDOS Protected. I've seen Remote DDOS Protection available from various sites but ...
1
vote
3answers
417 views

routing single ip to multiple reverse proxies

I have multiple servers running nginx reverse proxies pointing to the same ip adress because I need to keep 100% uptime and my service relies on them to hide real ip from malicious attackers and not ...
0
votes
1answer
62 views

When an ISP is DDoSed, will its NOC have Internet access?

When an ISP is hit by a huge DDoS attack and its data plane is severely congested, will its Network Operations Center (NOC) have alternative Internet access? I'm curious what would be the industry ...
0
votes
0answers
116 views

convert iptables rules to equivlaent ip6tables rules (CentOS7)

I have the following iptables rules for a CentOS7 web server. I would like to get ip6tables equivalent rules for them. Please let me know, if any changes are required between these and ip6tables rules ...
2
votes
1answer
49 views

Nginx - how to log an empty SSL connection with no request line

We are currently under DDoS with the following vector: Attacker is establishing TLS connection then drop off. (No request line is being sent) This is causing serious CPU load on nginx cluser. We ...
1
vote
0answers
22 views

How does DDOS mitigation partners filter out the bad traffic?

I am currently reading about ddos mitigation techniques. I came across a thing called proxy servers and ddos mitigation partners, who can help prevent ddos. The proxy servers actually hide your actual ...
0
votes
0answers
302 views

apache2 proxy error - are we beeing attacked / hijacked?

We are getting a lot of load since 2 days on our webserver (apache2.4, wordpress + woocommerce, nodeJS server) Now I saw a lot of URLs in the error logs which I dont know. Most of them from china. It ...
0
votes
1answer
68 views

My web server is being hit, all resources are maxed out, how to find out the root cause?

Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, ...
0
votes
0answers
40 views

Apache :mod-status shown too larg requests for images directory

I use Apache on my server , My server stopped multi times cause too large requests for images directory! (my server not for download images) different IP and Proxies make this attack ,I can't stop ...
0
votes
1answer
581 views

Block direct port 80 access on default IP using iptables?

I am using nginx with cloudflare in front of my sites to protect them from layer 7 attacks but now some attackers found this new way and they are daily attacking my default IP directly with layer 7 ...
-1
votes
1answer
727 views

linux ddos attack and blocking

im checking ddos using this script: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n it will show something like this 24 220.160.239.126 25 42.80.231.240 26 182.109.15.223 ...
5
votes
4answers
883 views

DDoS block source IP at ISP

During a DDoS attack even when you successfully stop it at your datacenter the link between you and your ISP will still be saturated and traffic brought to a halt. In this case what is the best way ...
1
vote
0answers
246 views

Websocket and CDN

I have an application which replies on both http and websocket: it is hosted outside the company server farm. This application is used both via browser/websocket and, through http, from applications ...
0
votes
1answer
1k views

My hosted server is being used to DDoS using LDAP, how do I stop it?

I recently was told to manage our exchange server because the person responsible left without decent warning. I have next to no experience in this regard, however everything was running smoothly for a ...
0
votes
2answers
189 views

About an idea to parry DDoS attacks

Background: I'm building a web application using Amazon API Gateway, Amazon S3, AWS Lambda and so on. Note: If you don't know about AWS, any pieces of advice would be highly appreciated. Searching ...
0
votes
2answers
147 views

My server is under DDoS. What does this log mean?

Earlier today I got an email from my hosting provider that my server is being DDoSed. I found in log file many suspicious requests with some random site names like dekhockeyvicto.com, workout.de and ...
-4
votes
1answer
52 views

under ddos with several search engines [closed]

I am under ddos with several search engines Any idea how can I stop this? 198.x.x.x - - [04/Sep/2017:17:12:11 +0100] "GET / HTTP/1.0" 302 403 "google.com/results?search_query=i7j0O" "Mozilla/5.0 (...