Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [ddos]

A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

Filter by
Sorted by
Tagged with
0 votes
1 answer
48 views

DDOS AWS API Gateway protection

I have publicly exposed API Gateway (HTTP). To authenticate you have to provide a valid JWT. I want to secure this APIGW with Cloudfront + WAF. After reading docs I think that API Gateway endpoint is ...
user avatar
0 votes
1 answer
26 views

How to get DDOS+WAF protection on IP/server (not domain)

I've used CloudFlare and it's great. But in this specific case we control the server IP address but we don't own the domain so can't use CloudFlare unfortunately because the domain owner isn't ready ...
user avatar
0 votes
1 answer
40 views

(Theoretical view) In a DDoS attack via docker, no correlation found between the amount of sent packets and the number of virtualized containers

I have been testing a DDoS attack in my local network via docker. Each image has loaded with an "evil" DDoS file. I tested simultaneously several containers attacking at the same time. On ...
user avatar
0 votes
1 answer
519 views

Best way to enable DDoS protection on many individual GCP compute instances without load balancing?

I've been scouring through the Google Cloud Armor docs for information about DDoS protection of a GCP compute VM instance. From what I've found, Google Cloud Armor Managed Protection provides ...
user avatar
0 votes
2 answers
35 views

Need to investigate why our server was DDOSing our host service provider

Hello everyone and hopefully somebody can give me a first step where I can begin investigating the reason to know why our Linux server appears to have attacked our service provider where the server is ...
user avatar
0 votes
3 answers
88 views

PHP Maximum execution time exceeded - sign of attack?

We were facing a very high CPU load on our web server today. Our application was freezing and not reaction. We could reduce the load by setting the maximum execution time from 180 to 90 seconds. ...
user avatar
  • 103
0 votes
0 answers
40 views

WAF-protected ALB scaling costs in DDoS scenario

I have an ALB behind Cloudfront. Both of which have SSL certificates and therefore provide SSL offloading, both protected with WAF WebACLs. The ALB's ACL checks a header - a common practice protecting ...
user avatar
0 votes
0 answers
228 views

Prevent SlowLoris attack with ModSecurity (Apache)

I'm unable to stop a SlowLoris attack using ModSecurity in my apache (2.4) server from a computer that is in the same network. I'm on Debian 11. I add this to the /etc/modsecurity/modsecurity.conf : ...
user avatar
0 votes
0 answers
117 views

How many pre-configured WAF rules do a small website needs? (GCP Cloud Armor)

I am looking at GCP Cloud Armor product. They charge $1 per-rule a month. There is this document with pre-configured rules: https://cloud.google.com/armor/docs/rule-tuning Can you tell how much of it ...
user avatar
0 votes
0 answers
45 views

mod_evasive: DOSPageCount and NAT

When configuring mod_evasive am I correct in the assumption that only the potential attacker's IP address is considered and nothing else? If that's the case I find it strange that everywhere for ...
user avatar
0 votes
1 answer
258 views

How to hide Origin Server IP address from Reconnaissance tools

When it comes to web server security, I am a paranoid person. On DigitalOcean, I'm running a server. They refer to it as a Droplet. Cloudflare is my DNS provider, and Cloudflare proxies and protects ...
user avatar
0 votes
0 answers
77 views

Apache Centos Stop Working Suddenly in Production Server

I have Apache/HTTPD server at GCP (VM Instance) with version Server version: Apache/2.4.6 (CentOS) Server built: Nov 16 2020 16:18:20 Since I was a developer, I don't advance with server ...
user avatar
  • 157
1 vote
0 answers
37 views

named rate limiting - DDOS prevention

I'm wanting to implement some rate-limiting onto our named servers and am looking for some help on making sure the values are "sane". This is what I'm thinking... rate-limit { errors-per-...
user avatar
  • 111
-1 votes
3 answers
258 views

DDOS Attack to http server and iptables doesn't help (i have access_log) [duplicate]

Im under a DDOS attack that target http server, i try iptables and other measures but nothing seems to work. Here is part of access_log: https://pastebin.com/6JFKmUi8 Lot of connections but iptables ...
user avatar
0 votes
1 answer
48 views

How to restrict AWS access to queries from specific domain names?

Hello, this is my first post on Server Fault, so please feel free to edit/correct etiquette. I am managing a server at work that we have hosted on AWS. Recently, it has fallen victim to a DDoS attack....
user avatar
  • 1
0 votes
0 answers
99 views

Fail2ban exited and didn't start back up

Today I faced a what seemed like a DDOS attack. My server provider warned me about excessive CPU usage (400% for over 6 hours) and I couldn't access any website, could not login via SSH either. Lish ...
user avatar
  • 251
0 votes
0 answers
69 views

How to protect Backend server from DDoS

I live in a country where there is no DDOS protection for game servers ( UDP Protocol ). Since latency is important for users, I can't host it in other country or region. So I have only one option ...
user avatar
17 votes
7 answers
4k views

How can I protect SSH?

I check /var/log/secure and I have these logs: Jul 9 13:02:56 localhost sshd[30624]: Invalid user admin from 223.196.172.1 port 37566 Jul 9 13:02:57 localhost sshd[30624]: Connection closed by ...
user avatar
  • 181
0 votes
1 answer
77 views

What does AWS EC2 DDOS protection shield throw when activated? HTTP(S) 503?

What does Amazon AWS EC2 DDOS protection shield throw when activated? HTTP(S) 503? At which amount can this happen? 5000 - 10000 requests at "the same time"? Is this public info and ...
user avatar
  • 494
-2 votes
1 answer
90 views

How can my users discover my upstream server IP though they only connect through load balancers?

I am managing a game server prone to DDoS. I have kept the upstream IP secret and only published the addresses of 100 load balancers forwarding traffic via iptables: echo 'net.ipv4.ip_forward=1' >&...
user avatar
1 vote
0 answers
23 views

Application role in preventing DDOS

I have an application that is being planned to be exposed to internet clients via a reverse proxy deployed in the DMZ, . I have recommended that the deployments use WAF/Cloudflare along with this to ...
user avatar
1 vote
1 answer
92 views

What happens when a post exceeds the limit of post_max_size?

If I send a payload of, for example, 10MB to an apache server, the limit being 2MB. How does the server know that the payload is 10MB? Doesn't he need to receive the file anyway, and check its size? ...
user avatar
1 vote
1 answer
565 views

How to prevent DDOS attack impact on Netlify? (downtime + bandwith usage/cost)

Situation: React app that was initially running on a VPS A few days ago, we were the target of a DDOS attack that took the site down. During the attack, we decided to migrate to Netlify. Once ...
user avatar
0 votes
1 answer
184 views

I'm Under attacks even with mod_evasive mod_security and fail2ban [closed]

I have my centos fresh server with no problem, I have httpd, named but I get 150 failed logins per 10 minute. I also use Fail2Ban with maxretry 1 findtime 6h. and mod_evasive mod_security default ...
user avatar
0 votes
2 answers
104 views

Can CDN caching prevent DoS attacks?

Let's say I use Cloudflare to cache my images, CSS, and JS files. Requests for the HTML content itself still hit my server and an attacker could use that to his advantage. However, if I tell ...
user avatar
  • 103
0 votes
1 answer
49 views

How to prevent a lot of strange requests

I have and https site, which for one week receives a lot of strange requests just to main web site page (+ 2 js and 1 css files, but no images). From nginx logs it looks like: 193.151.188.114 - - [02/...
user avatar
  • 137
0 votes
1 answer
257 views

UFW Weird ICMP log record - Pinging is blocked

In the log records below I have replace my eth MAC address with ETH_MAC_ADDRESS the IP of my server with MY_SERVER_IP and other IPs with STRANGE_IP plus a number to distingue. Jan 29 15:11:48 cld ...
user avatar
  • 113
0 votes
0 answers
84 views

Extremely high incoming traffic on web server but no abnormalities in log files

Today we recorded extremely high incoming traffic (1 Gbps) on our Debian Webserver (green chart). On an average day it's at a maximum of about 20-30 Mbps. Firewall as well as fail2ban are configured ...
user avatar
  • 103
2 votes
0 answers
194 views

iptables performance during high-pps UDP attack

One of my servers is under constant UDP DDOS attack. ~500Mb/s and 700k PPS. I have a 10Gbit downlink so that is not the bottleneck. In my IPTABLES I have created a 'whitelist' via ipset and dropping ...
user avatar
  • 21
0 votes
0 answers
83 views

How much DDOS mitigation one should expect from VPS provider?

We had a stateful WebRTC application which received some DDOS attacks. The server had 2gbits port, so any attack over 2gbits was able to make it unavailable. Afterwards we refactored the application ...
user avatar
  • 101
-5 votes
2 answers
123 views

Can I report malicious ip addresses for money?

My servers get attacks from thousands of ip addresses everyday. I have an idea. Can I report those malicious ip addresses, or use the resource to earn some money? How? You may think these attacks are ...
user avatar
  • 69
0 votes
2 answers
73 views

DDOS protection without IP?

Is there any way to do DDOS protection without logging IP addresses? Any way to stop attacks without noting down IP addesses? This is because of data protection regulations
user avatar
1 vote
2 answers
245 views

Ddos Protection syntax - Nginx

I am using this syntax for my Nginx configuration file /etc/nginx/nginx.conf which reads: user www-data; worker_processes 2; pid /run/nginx.pid; worker_rlimit_nofile 100000; events { ...
user avatar
  • 479
0 votes
0 answers
51 views

DOS Attack from local network to wan, identification and Prevention

Past few days, we have been facing a possible syn flooding DOS attack. This attack happens twice a day (afternoon and at night), one random IP in our network gets active (even though the system on ...
user avatar
0 votes
2 answers
193 views

How to stop requests on PHP server while it is running cron job sheduled PHP script?

I have a situation when some DDOS attacks are putting my PHP server down. Occasionally. I'm using AWS with auto scaling groups, so it is not a problem. The problems start when this server is going ...
user avatar
0 votes
1 answer
46 views

Meaning of Log File (DDOS) [duplicate]

We are currently facing attacks (probably DDOS) on our server. The incoming network traffic goes from an average of 20Mbps to 1Gbps in just 2-3 minutes. The lines in our log files usually look like: ...
user avatar
  • 103
-2 votes
1 answer
280 views

How to secure a home server from a DoS attack? Questions about research [closed]

I have made research on several types of attacks, this page is a sample. Some attacks are not insanely harmful to overall system while most attack types are preventable by being careful or with the ...
user avatar
  • 103
0 votes
1 answer
320 views

Hitch rate limiting without Varnish

Good morning, Is there a way to implement per-site and per-IP rate limiting on Hitch before the request reach Varnish? I tried to handle some DoS attack using Varnish rate limiting, but the DoS can ...
user avatar
1 vote
1 answer
210 views

Tons of Access from Google Proxy

I freaquently have a lots of access from google proxy. It says it is Google Favicon bot and I've checked it by host command. User-agent is like following. "Mozilla/5.0 (X11; Linux x86_64) ...
user avatar
  • 11
0 votes
0 answers
134 views

Azure container instance receives tremendous traffic even right after its creation

I've created an Azure container instance with MSSQL container image. It starts. However before even login, or even putting the URL in to use, I've checked the container logs and it's being hit with ...
user avatar
  • 191
2 votes
1 answer
190 views

Receiving a lot of NTP requests

On my server I see a lot of NTP requests. All NTP traffic is blocked by iptables. Is there anything more I could do to stop this traffic? 28M 1019M DROP udp -- * * 0.0.0.0/0 ...
user avatar
2 votes
1 answer
1k views

Prevent DDOS Attack on GCP App Engine

I've launched my application on GCP App Engine with 8 micro-services. I did an overload test with apache j-meter and it seems to scale well. However this can also be used as a DOS attack on my ...
user avatar
-1 votes
1 answer
66 views

How to block / deny linux user from accessing a site with htaccess? [duplicate]

My site got hit ddos several times till now, i found that ddos traffic generally comes from linux os ... then, i wonder how to block linux users / traffic from accessing a site with htaccess?? Please ...
user avatar
  • 13
0 votes
1 answer
91 views

Does cloudflare provide anti-DDoS protection for dedicated servers?

I have a dedicated server that sometimes gets DDoS attacked. Does Cloudflare give you protection for dedicated servers or is it for websites only?
user avatar
0 votes
1 answer
377 views

DDoS & Amazon Lightsail Load Balancing

One of the sites I host on Amazon Lightsail recently became victim of a DDoS attack. I've been able to fend it off using Cloudflare's "I'm under attack" mode. I'm wondering if load balancing ...
user avatar
1 vote
1 answer
532 views

Detect SYN flood attack in python

I have a piece of python code as follow s = socket.socket() s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) s.bind((IP, PORT)) s.listen(256) while True: revdata = "" try: ...
user avatar
  • 33
0 votes
1 answer
223 views

iptables - synproxy target don't mark packets as INVALID

I am writing iptables rulles and have problem with preventing flood SYN. Found that synproxy should be the right solution. But when testing, I found that it don't mark packets as INVALID, so iptables ...
user avatar
  • 588
0 votes
1 answer
2k views

How can do Load Test against WebSocket?

We will have to do a load test for the first time. To tell the truth, I don't know exactly what to look for and how to do it. I have also researched resources on this subject but I could not obtain ...
user avatar
0 votes
0 answers
397 views

Cisco ACL to block external DNS queries [RESOLVED]

One of the routers that I administer is getting bombarded with external DNS queries from the internet. This is a network border router which has a DNS server configured. There is an interface facing ...
user avatar
3 votes
1 answer
277 views

DDOS manual mitigation using command netstat. How to determine real attackers?

When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server: netstat -npt | grep SYN_RECV | awk '{print $5}' | grep -Eo '(...
user avatar
  • 137

1
2 3 4 5
13