Questions tagged [ddos]
A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
628
questions
0
votes
2
answers
2k
views
iptables DROP counters
I've discovered strange connections to my web server from 10 different IP addresses with same subnet 46.229.168.0/23.
This subnet belongs to a hosting provider and hardly represent real users.
After ...
- 143
0
votes
1
answer
627
views
How to prevent "GET slash" http DDoS attack from frontend
Yesterday our webservers running Apache2.2 got DDoSed from a botnet which caused nine (9) hours downtime. The attacker was just creating too many "GET /" connections with result our servers to reach ...
- 1,844
1
vote
1
answer
2k
views
Preventing denial of service attacks on weblogic servers- slow http post
I am using Weblogic 12c(12.1.3) application server to run my application. I have configured complete message timeout in Weblogic to 30 seconds but when Qualys scan is running on this server, it can ...
- 11
0
votes
1
answer
2k
views
mod_evasive doesn't do anything on Ubuntu server 16.04
I set up mod_evasive on Apache/2.4.18 using this guide: https://komunity.komand.com/learn/article/server-administration/how-to-configure-modevasive-with-apache-on-ubuntu-linux/
I only changed email@...
- 101
-1
votes
1
answer
4k
views
snort rule for rdp dos attack
i am very new in snort rules so i can't find the below rule exactly . is this rule send alert when tcp packets come from external network and any port to home network and port 3389? just check port , ...
- 1
1
vote
1
answer
4k
views
udp flooding prevention using iptables
i want prevent udp flooding so i think if i drop all udps that don't come from the internal network and not relate to a udp connection i can prevent udp flooding. in the other word if only udps that ...
- 11
-2
votes
1
answer
94
views
Is public search form vulnerable to DDOS attack?
I have a typical search form as one of the main functions. As it is a public one, I am scared of getting DDOS attacked.
The only way I think of to avoid it is to:
I will use a method="post" form ...
- 101
2
votes
2
answers
7k
views
Does AWS Load balancer prevent DDos effectively?
I have a small but popular local website, it is a nonprofit venture. We arrange programming contest. But randomly in some contest our servers goes down. For example in last contest, we had around 300 ...
- 35
3
votes
4
answers
2k
views
Man in The Middle Attack, or something else?
I was wondering if someone could help me out with this problem.
We have a webservice that is available only through https:// port 443.
Using netstat I see that there is particular ip that tries to ...
- 143
0
votes
1
answer
1k
views
Azure VM DDOS attack via RDP
Yesterday my VM on Azure was under a DOS attack.
Symptom was I wasn't able to connect via RDP, unless the server was freshly rebooted, and only for a small fraction of time after the reboot.
Once I ...
- 15
0
votes
1
answer
911
views
Auth.log with hundreds of entries per seconds
My Auth.log is becoming super heavy (80G per file) due to constant entries coming from a lot of different IP.
Jun 20 14:00:36 localhost pluto[1796]: packet from 180.30.141.75:20532: Received packet ...
- 123
1
vote
1
answer
91
views
Protecting against problematic scraper \ mild DDoS from AWS servers
we currently have an issue where someone(s) with many different IP addresses, all belonging to AWS is scraping \ making many requests per second to our public server. User agents are randomized and ...
- 253
1
vote
1
answer
981
views
Nginx limit_req is killing all requests
i have a website running on node.js and express web server.
i'm using nginx to run website on domain and also use ssl certificates.
I searched google for how to protect server from ddos attacks using ...
- 33
1
vote
1
answer
548
views
How to solve post request ddos
Today our magento shop is under attack, I am hoping someone can help tell me how to block these requests from 100's of different IPs:
182.255.44.234 - - [15/May/2017:13:24:14 +0100] "POST /calais-...
- 11
0
votes
3
answers
6k
views
Using iptables to prevent SSH brute force attacks and DDOS attacks
I have the following lines at the very top of iptables, these are used to prevent SSH brute force attacks and DDOS attacks:
iptables segment to prevent SSH brute force attacks and DDOS attacks
What ...
- 1
0
votes
0
answers
97
views
How to detect which of my server IPs DDoS attack is directed at?
I have a dedicated server with Windows Server 2008 R2. I have more than 10 IPs assigned. My usual load is under 5%. Sometimes I experience DDoS attacks, my traffic goes up to 30%-50%, then I lose ...
- 31
0
votes
1
answer
426
views
GRE With scaleway
i'm having some problem here to create a GRE tunneling,
it' theoretically simple, i have 2 clouds, one, with DDoS Protection,
and another, without that.
In my first cloud, it have DDoS, hosted in OVH, ...
0
votes
1
answer
500
views
Are anti-DDoS rules unnecessary if NEW state connections are dropped on the INPUT and FORWARD chains?
Scenario: A router is used to connect internal clients to the Internet. The router does not provide open services to the Internet.
Let's say you have iptables rules like the ones below and no others.
...
user403619
3
votes
1
answer
183
views
DDOS-style requests from initially legitimate users of Firefox revision 52 (latest) -- extension causing it?
I wonder if anyone else has seen similar phenomena to what a site I help manage is experiencing. For the last two weeks or so, about 10-15 times a day we will get thousands to tens of thousands of ...
- 133
1
vote
5
answers
649
views
How do you mitigate LAN clients from participating in DDOS?
Most references I've read about mitigating DDOS involve edge routers.
However, is there anything you can do to mitigate your LAN clients from unknowlingly participating in a DDOS ?
Like blocking ...
user403619
0
votes
1
answer
3k
views
Analyzing nginx webserver logs to detect DDOS attack
I recently experienced a DDoS attack. How do I analyze nginx webserver logs from that time window to detect what kind of DDoS it was? I'm using Microsoft Azure infrastructure (in case it matters).
I ...
- 2,575
2
votes
1
answer
3k
views
How does URL redirection affect DDoS attacks?
We're moving our company website to a new domain and a new hosting provider as part of a re-branding project. We intend to create completely new content for the new website, remove all content from ...
- 73
1
vote
1
answer
2k
views
How to deal with TCP connections attack on Linux
My server is being flooded until apache becomes non-responsive, and I need some help finding and blocking the responsible IP address(es).
Normally, I don't have more than 150 connections. Now I have ...
- 709
2
votes
1
answer
736
views
TMG only windows 2008 r2 installing. NOT WORKING windows server 2012 r2
TMG Forefront only working windows server 2008 or 2008R2 - Not working windows server 2012.
How to mitigation windows server 2012R2 - Flood attacks,http attacks ?
Please help how to build windows ...
2
votes
1
answer
2k
views
Linux block udp on low-level against DDOS
My server is currently under DDOS attack with nearly 500k UDP packets per second.
UDP is blocked in iptables but the processor is still overloaded.
Any way to block UDP on a lower level to not pass ...
- 23
0
votes
0
answers
128
views
Possible ddos attack and exim failing - apache server
We have a dedicated server which one of the sites is gettinga huge amount of traffic and overloading the server.
It seams exim is also getting attacked.
I have kind of inherited this server and im at ...
- 1
0
votes
0
answers
79
views
Block a domain name from accessing my server
I am facing a weired issue, my site is under attack, upon further checking i found that a particular domain is the one hitting my site/server. I blocked the IP of that culprit domain but it keeps ...
- 101
-1
votes
1
answer
1k
views
How to reroute a DDoS attack to the attacker?
I would like to know if there is a way to block and reroute a DDoS attack I'm receiving on my website to the attacker website (I know the address of it).
If so, how can I do that? I'm using ...
- 1
0
votes
1
answer
498
views
Mitigating HTTP Flood and Wordpress pingback DDoS
I'm an experienced Web Developer but new to servers. I've been learning on Digital Ocean and one of my sites is being constantly hit with DDoS attacks. I've identified two attacks, one is HTTP GET ...
- 3
-1
votes
1
answer
122
views
Possible DOS Attack or computer "freak out"
I am a dev-ops web developer with a site running two ec2.smalls behind a load balancer on AWS.
Recently we saw 3-4 requests per second take down our clients site.
The site was down and would not ...
- 315
1
vote
2
answers
326
views
Mod_evasive default parameters
I have configured mod_evasive with below configuration. I dont understand difference between DOSPageCount and DOSSiteCount.
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount ...
- 11
1
vote
2
answers
3k
views
Iptables rules to prevent IP Spoofing
We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing:
-A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
-A INPUT -s 255.0.0.0/8 -j DROP
-A ...
- 523
0
votes
1
answer
168
views
Is there some type of DNS server amplification attack possible by querying servers for non-existent domain names?
In working with Bind DNS servers, which are not open resolvers and do not perform recursive queries, I see a great mumber of incoming DNS query requests, that are denied or refused, that focus on ...
- 99
0
votes
1
answer
2k
views
DDOS - Google Cloud Instance vs. Amazon AWS
I am planing to launch a little Website but i am afraid of DDOS Attacks and the additional costs there would be charged.
I read that Amazon EC2 is not charging the inbound http requests?
What is ...
google-cloud-platform
2
votes
1
answer
1k
views
Stop requests to xmlrpc.php after Wordpress uninstall
I had a previous installation of Wordpress in my server and after a DDOS attack, I blocked the access to the xmlrpc.php file from the .htaccess file:
<Files "xmlrpc.php">
Order allow,deny
...
- 327
1
vote
1
answer
4k
views
How do I block UDP while still allowing outbound UDP connections with iptables?
I would like to drop all UDP traffic (everything else is allowed) while still allowing outbound UDP traffic. The outbound traffic is mainly from gaming and voip calls. The UDP traffic needs to be ...
user353498
2
votes
2
answers
127
views
What would happen if someone would flush host from Google public DNS while it's name server is down?
During the recent DDoS attack on Dyn servers, many websites couldn't be reached for quite a while. However, these websites were resolvable via Google's public DNS servers. I assume IP addresses were ...
- 133
0
votes
2
answers
151
views
Server is currently under massive DDoS
Over the past few days, been having a number of problems that I can only describe as a massive DDoS attack one a CENTOS VPS server that is only hosting one website.
The website is really slow but not ...
- 101
-1
votes
2
answers
164
views
How trustworthy are Arch's official repositories? [closed]
I have a server with Arch Linux installed and for some reason, it gets infected after a period of inactivity. I reinstall, remain inactive for some time and it gets infected again. Every time I ...
- 1
1
vote
1
answer
697
views
Did I properly mitigate a DDOS?
Last evening my forum was victim of a DDOS Attack in the form of a DDOS Attack. I've confirmed it was an HTTP Flood.
The first thing I did was enable CloudFlare's checking your browser. It blocked a ...
user353498
0
votes
1
answer
297
views
Server does not receive request - named issue?
We've been under ddos attack today and it all started there.
Here's our setup:
We use CloudFlare as a DNS service (no caching, just pointing to our server ip, so this is 8)
We have an anti-ddos ...
2
votes
2
answers
5k
views
DDoS mitigation / prevention with nginx
(To work around the "is a duplicate" issue: I don't see many requests. The number is rather small. Instead, each request downloads a lot of data.)
The server I'm talking about has 2x10 GBit/sec of ...
- 374
-3
votes
2
answers
4k
views
Need Help My Server Got so many CLOSE_WAIT Connections
I need help because my linux ubuntu server are getting too many SQL connections, and when I checked using netstat -t there are many connections like these:
tcp6 1 0 websitesaya.co.id:http 98-142-172-...
- 37
0
votes
1
answer
126
views
Possible DDoS (not sure). Cannot trace with netstat
I have a KVM node I'm running with only 7 VM instances. When GigE uplink port is enabled, server connection goes crazy hitting over 300MBps somehow. I cannot trace which IP is possibly being attacked, ...
- 63
-1
votes
2
answers
398
views
How to count the number of SYN, ACK, or SYN-ACK in a second? [closed]
I want to make a DDoS SYN Flood Detection, so i need to count the number of SYN, ACK, or SYN-ACK packet per second.
0
votes
1
answer
357
views
Attempting to block "wordpress" useragent is overloading CPU [duplicate]
I've had some DDoS issues - specifically the XML-RPC exploit (wordpress) wherein thousands on thousands of Wordpress instances attack my machine.
I have the following in my nginx server block:
...
- 9
-1
votes
1
answer
303
views
Run shell script on the event of "possible SYN flooding"
I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file.
So, is it possible to trigger a script/...
- 633
2
votes
1
answer
8k
views
Handle "possible SYN flooding on port 443. Sending cookies."
My website constantly has several users online all the time.
The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast.
However, the server appears to ...
- 633
16
votes
3
answers
4k
views
Dealing with NTP reflection attacks in IPTables
We're dealing with an NTP reflection / amplification attack at our colocated servers. This question is specific to responding to NTP reflection attacks, and not directed at DDoS in general.
Here's ...
- 13.2k
-4
votes
2
answers
157
views
Does it make sense to have a server dedicated to login? [closed]
Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks.
Is it a good idea to put the login portion of the app on it's own dedicated ...
- 101