Questions tagged [ddos]

A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

Filter by
Sorted by
Tagged with
0
votes
1answer
12 views

How can do Load Test against WebSocket?

We will have to do a load test for the first time. To tell the truth, I don't know exactly what to look for and how to do it. I have also researched resources on this subject but I could not obtain ...
0
votes
0answers
27 views

nginx, http ddos protection crawled?

What is the best way to prevent crawlers from caching the "javascript verification" page? With Google there are no problems, but Bing does seem to cache it. All it takes - for the bot - is to reload ...
0
votes
0answers
64 views

Cisco ACL to block external DNS queries [RESOLVED]

One of the routers that I administer is getting bombarded with external DNS queries from the internet. This is a network border router which has a DNS server configured. There is an interface facing ...
1
vote
0answers
29 views

DDOS manual mitigation using command netstat. How to determine real attackers?

When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server: netstat -npt | grep SYN_RECV | awk '{print $5}' | grep -Eo '(...
0
votes
2answers
52 views

How can I test the security of my server? I think I am under DoS

I got a server with Windows OS. The server is running many VMs using HYPER-V. The VMs are exposed to the internet. There is a single VM that is running NAT using windows RRAS, ehich is connected to ...
0
votes
0answers
16 views

Can someone pont me to a definition of a Bonnet in a DDoS context?

I have a new access point with some built in Ai security features including some DDoS mitigation tools. The site that explains the feature mentions that the access point could still be impacted by a ...
0
votes
0answers
10 views

What's the size of the SYN / ACK queue and how to change this parameter? (and other SYN flood mitigation techniques)

My provider informed me that a SYN flood attack has happened on a server (and they mitigated the Ddos). I understand that many SYN are sent by the attacker, SYN-ACK are sent by my server, but then ...
0
votes
0answers
16 views

How to force queue delay to slow down script kiddie DOS?

We have a pretty busy web service with two HAProxy balancers in front of it. Sometimes we get script kiddie level distributed DOS (DDoS) attacks where low number of attack servers (around 100 or less) ...
2
votes
2answers
822 views

Newbie Help! Windows Server 2012 R2 being hacked for DDos

I use a German server for RDP. Recently I received an email from my server provider that my server participated DDoS attack. It's so scary! Can anyone point a direction on how to resolve the issue? ...
0
votes
0answers
16 views

ModSecurity3.0 + Nginx + DDOS is there any way to configure the rules?

I read in documentation by Nginx, that ModSecurity 3.0 is not supporting DDOS mitigation rules(REQUEST-912-DOS-PROTECTION.conf) for Nginx. That documentation was published in 2018, Any idea is there ...
0
votes
0answers
14 views

Secure Sendmail against Backscatter

I'm running Sendmail 8.15.2 on Debian 10.3. My server is again and again blacklisted on backscatterer.org (normally it's listed, after four weeks it's delisted again, but three or four weeks later it'...
0
votes
1answer
53 views

OVH server DDOS attack protection

I purchased the server on ovh.com. (not gaming, regular) For 3 days now I’ve been trying to set up protection against DDOS flood. Nothing comes out. Support responds once a day and does not give an ...
0
votes
1answer
42 views

Use ufw to block users from accessing my server via a specific vpn

The last couple of days I've been having some weird small DDoS attacks on different VPS's I have online. The first one I detected using netstat and I noticed a bunch of IPs that were from a ...
3
votes
1answer
27 views

Is this real google bot or attack? How do I deal with it?

So basically my site was unaccessible and I went to logs folder to see what's wrong and noticed a lot of weird requests from various IPs: 155.4.117.13 - - [30/Mar/2020:20:23:45 +0300] "GET / HTTP/1.0"...
0
votes
0answers
109 views

Apache too many child process - mpm_event caught SIGTERM shutting down

My Apache with ModSecurity, mod_evasive20 enabled occasionally geting crashed: These are glimpse of error log: [core:warn]**: child process 24709 still did not exit, sending a SIGTERM [core:error]**:...
0
votes
0answers
15 views

continuous hits my webserver with wordpress or Magento request but im not using either

I have a PHP website on AWS which is getting bad gateway so I have looked into Nginx server logs and found that an errors connect() to unix:/run/php-fpm/php-fpm.sock failed (11: Resource temporarily ...
2
votes
1answer
187 views

DigitalOcean Droplet and Managed Database with Load Balancer - DDOS Protection

I'll first start off by saying I'm no sysadmin or by any means knowledgable on servers, I'm just a developer tasked with a job of setting up the infrastructure for a SaaS application I'm working on, ...
0
votes
1answer
51 views

How to Hide real DNS server from OpenVPN?

OpenVPN show the DNS server in clear when you connect but i want to hide that from public. ( It shows that in logs and network adapter in Windows for example ) DNS server alreadly have rules to ...
0
votes
2answers
92 views

How do I limit ping (ICMP) responses on a debian 10 server?

I have a VPS with debian 10 installed, primarily used for website hosting. when I issue a ping to the server from a remote machine, I am able to and receive responses for packet sizes up to around ...
0
votes
2answers
44 views

My Site is under DDoS Attack [closed]

I hosted my website couponx.com in google cloud. For 24 hrs my site is under DDOS Attack. I have tried every way to get my site back. I spoke with Cloudflare as well. Still, the issue is not resolved. ...
0
votes
1answer
124 views

How to block FIN-WAIT-2 by iptables?

My site now is under ddos-attack, "ss -ant" shows a lot of FIN-WAIT-2 (and some FIN-WAIT-1) connections from one ip (and random ports), about 500-700 connections: FIN-WAIT-2 0 0 ::ffff:...
0
votes
0answers
35 views

Nginx rate limiter doesn't work for the 301 response - is there any security/attack risk?

I've learned that if I have a http/https permanent redirect rule (return 301 on http and point to https), the rate limiter does not apply when querying the http server. The reason is that the rewrite ...
0
votes
1answer
25 views

Using different rate than the default 1/second in iptables

This code does its job perfectly in limiting syn connections but in line 4 instead of 1/s i need it to be 1/5 seconds, it's an assignment i'm working on that needs to protect against syn-flood attacks ...
0
votes
1answer
95 views

sql server blocks after multiple failed connections from trusted ip

We have a high load sql server that is not externally exposed. The web server accesses the sql server over a lan. For the most part it works great but from time to time when the sql server has ...
0
votes
0answers
32 views

How to block traffic from incoming port?

I'm facing an issue with DDoS attack at my server, the ips which attack are different but their port is the same example: 120.20.30:3003 193.25.54:3003 201.54.11:3003 Is there any iptables rule ...
4
votes
1answer
78 views

What does modern DDoS prevention look like from a networking perspective? [closed]

I understand that there are network and IP-level mitigations for DDoS attacks, but I'm not clear on how they work in practice. My hope is that this question and answer will help to frame how the core ...
3
votes
0answers
86 views

Mitigating a DDoS attack on a TOR server

Running a political blog over TOR network with a .onion domain name I have been getting DDoS attack, I know how to mitigate an attack on clear net where the packets coming from normal IP addresses, ...
0
votes
1answer
54 views

ipset iptables drop all exclude ports but via rate limit

I have simple ipset map to track suspicious ips. These my commands: ipset flush ipset -q destroy banlists ipset create banlists hash:ip comment family inet hashsize 2048 maxelem 1048576 timeout 300 ...
0
votes
1answer
55 views

How to use Azure DDoS with App Service Plan

Is it possible to use Azure DDoS with an Azure App Service Environment or Plan? Everything I've seen relates to vnets but my Service Environment/Plan states Your app is in an App Service ...
0
votes
1answer
63 views

Misunderstanding with configuring iptables

It is possible to create iptables logic in such way? accept ssh,http,https drop connection if such ip is already connected (only 1 connection per ip / 1 second). put to blacklist (ipset I guess) if ...
0
votes
0answers
12 views

NGINX ddos filter implementation only with header informations

i would like to know if there is any kind of implementation to to create a ddos filter only by working with headers? In first place i guess some random header has to be generated in order to attache ...
0
votes
0answers
51 views

My ubuntu server got too many connections and cost all the bandwidth…

I have closed all my services, my ufw firewall only allows 443 and 80 port but there're still a LOT of different IPs with different ports connecting to my server and costing my server's bandwidth. I'm ...
0
votes
1answer
30 views

Under ddos attack, legit packets increase length also?

I would like to know about packets length, for example, with normal traffic (without DDoS attack) packets length is 20-40, which I believe is normal, once DDoS attack starts packets length goes over ...
0
votes
1answer
143 views

How to drop packets based on length?

could someone help to make iptables to drop all the packets with length 1006? Example: 18:33:18.964261 IP 74.209.87.132.3054 > 126.220.67.183.13806: UDP, length 1006
0
votes
0answers
61 views

My VPS tried to DDoS (or port scan) Columbia University, what can i do? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a MC ...
1
vote
1answer
413 views

Fail2ban ban is not working as expected [DDOS]

I have this jail: ##To stop DOS attack from remote host. [http-get-dos] enabled = true port = http,https filter = http-get-dos logpath = /usr/local/nginx/localhost-access.log maxretry = 100 findtime ...
0
votes
0answers
43 views

DoS attack Apache HTTP and all CPU goes 100%

We are getting a Dos attack on our web server. We enabled Cloudflare and add these rules: If it is not SSL connection Block all. That fixed pretty much all attacks. I would like to ask pros about ...
0
votes
2answers
318 views

Experiencing a DDoS on one of my GCP instances. What can I do?

I have a single instance running on GCP which right now's suffering from a load-based DDoS. It's a Debian-based instance proxying the traffic internally to a Geneweb daemon running on the same machine....
0
votes
1answer
47 views

Under volumetric DDoS can I prevent ISP null-routing by turning NIC off briefly?

A server in a data center is getting a volumetric DDoS attack. Congestion starts to build up and the data center/ISP going to solve this by null-routing (RTBH routing) the server's IP address for ...
0
votes
2answers
60 views

Server's unusual outgoing traffic about 12K GB and Incurred high server traffic costs

Last night my server(centos5) had unusual outgoing traffic, About 12kGB and right now my server is down because I have to pay that traffic's cost. My server is a small server for a small App. I don't ...
3
votes
2answers
227 views

How to mitigate backend stress generated from malicious traffic

I want to reduce, or mitigate the effects of, malicious layer 7 traffic (targeted attacks, generic evil automated crawling) which reaches my backend making it very slow and even unavailable. This ...
0
votes
1answer
314 views

Does AWS Network Load Balancer prevent DDoS

AWS ALB does routing based on content this means many common DDoS attacks like SYN floods and UDP reflection will be blocked. On other hand, AWS NLB does not absorb any traffic hence my backend EC2s ...
-1
votes
2answers
108 views

How exactly DDoS protection is built

When speaking about the DDoS protection, I can understand that it is massively dependent on the filter capacity. When building your own DDoS protection, it is dependent on the amount of traffic you ...
2
votes
1answer
61 views

Too many bad bots killing website

Everyday around 2-3pm, huge amounts of bots are coming to my website and they just kill it. Few days ago it was just 2-3 IPs so I could easily block it, but today more than 600 bots came and kept ...
-1
votes
1answer
60 views

Am I under ddos attack ? Many random requests (usually to images)

Do requests like these look like a DDOS attack ? 180.157.250.126 /9301451791bb460e8a5aec3e123884ba.jpg <<< match 180.157.250.126 /b29a2302afd6dfd918a2b7c3b6a05e31.jpg <<< match 183....
-2
votes
2answers
92 views

How does the DNS lookup query work?

Let's say, my domain's nameservers are registered like this: ns1.domain.com. ns2.domain.com. ns3.domain.com. The physical location for each of the server are as follows: ns1.domain.com. - in Tokyo ...
1
vote
2answers
101 views

Terminate EC2 Instance When DDoS'd, Then Launch New Instance

I'm planning on migrating my website and API to EC2 on Amazon. If one of my EC2 instances were to be DDoS'd, can I terminate the instance, then launch a new instance and update my CloudFlare DNS ...
0
votes
0answers
149 views

CENTOS 7 - Auto block IP with null routes

Whenever I notice overload on my media (videos) server, I check for ddos with this command from netstat: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n It shows currently ...
0
votes
1answer
177 views

Could a DDoS still result in low-latency ping replies?

I have a hosted server running Asterisk PBX with the following specs: Debian 9 x86 64bit Linux, 2GB RAM, 2TB bandwidth, and 20 GB SSD storage. For almost a day now, the server has been seemingly "...
0
votes
1answer
2k views

How to interpret Firewall logs?

Today I have found few failed auth attempts on ssh server and I decided to check all logs for suspicious activity. Here are my router firewall logs (small part of it): Dec 12 21:24:12 kernel: DROP IN=...

1
2 3 4 5
12