Questions tagged [ddos]
A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
628
questions
-2
votes
2
answers
142
views
How does the DNS lookup query work?
Let's say, my domain's nameservers are registered like this:
ns1.domain.com.
ns2.domain.com.
ns3.domain.com.
The physical location for each of the server are as follows:
ns1.domain.com. - in Tokyo
...
- 137
1
vote
2
answers
316
views
Terminate EC2 Instance When DDoS'd, Then Launch New Instance
I'm planning on migrating my website and API to EC2 on Amazon. If one of my EC2 instances were to be DDoS'd, can I terminate the instance, then launch a new instance and update my CloudFlare DNS ...
- 67
0
votes
0
answers
374
views
CENTOS 7 - Auto block IP with null routes
Whenever I notice overload on my media (videos) server, I check for ddos with this command from netstat:
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
It shows currently ...
0
votes
1
answer
412
views
Could a DDoS still result in low-latency ping replies?
I have a hosted server running Asterisk PBX with the following specs: Debian 9 x86 64bit Linux, 2GB RAM, 2TB bandwidth, and 20 GB SSD storage.
For almost a day now, the server has been seemingly "...
- 214
0
votes
1
answer
12k
views
How to interpret Firewall logs?
Today I have found few failed auth attempts on ssh server and I decided to check all logs for suspicious activity.
Here are my router firewall logs (small part of it):
Dec 12 21:24:12 kernel: DROP IN=...
- 11
0
votes
2
answers
226
views
huge traffic from different IPs on my ubuntu vps
I've change my vps recently, vps provider told me that he has backed up my VPS hdd from previous server and deployed it on the new server and changed just my ip, but now I have a huge traffic and ...
0
votes
1
answer
190
views
Can this be consider as a ddos (logfiles)
our server crashed yesterday for the 1 time after one whole year. So i checked the logs and find some strange things. There is one ip that make about 450 individual site-requests in a 12 min period of ...
- 1
4
votes
1
answer
1k
views
Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)
This is a two part question, really. Keep in mind that I am a developer not a system admin, but being the only employee in the company, I wear ALL the hats.
I have deployed my server with two ...
- 171
5
votes
3
answers
8k
views
What is a good way to detect DoS and DDoS in Fail2Ban?
I am configuring Fail2Ban on my Ubuntu web server to prevent it from being a victim of DoS / DDoS. I don't want to use Cloudflare because I have to route my DNS over and use their SSl cert.
...
- 365
1
vote
1
answer
1k
views
Azure Ubuntu VM: Is a connection to 168.63.129.16:80 mandatory for Basic DDOS protection?
Yesterday I noticed some suspicous activity when running netstat | grep http on my Azure Ubuntu VM:
There were over 60 lines like this:
tcp 0 0 ser:http hosted-by.blazing:...
- 782
2
votes
0
answers
95
views
Will More vCPU's and RAM Help Protect Against Some Smaller Scale DDoS Attacks?
Obviously having more vCPU's (virtual CPU's) and more RAM by them self won't be able to alone help stop and/or prevent a DDoS attack, but let's say after a DDoS attack is finished and/or slowing down ...
- 21
1
vote
1
answer
1k
views
Slow SYN flood: preventing SYN amplification?
a (linux) webserver I administer (on a VPS) for a low volume website has just been subjected to about 5 SYN requests/second on port 80, with no other traffic coming from the remote host.
It was more ...
0
votes
1
answer
469
views
Configuring postfix or other software to route mail through Cloudflare or other ddos protection?
So I'm looking to set up my own mail server with postfix, but I've currently routed my web server through CloudFlare. Is there a way to route all outbound emails through some sort of proxy or ddos ...
- 113
1
vote
1
answer
2k
views
DDoS Mitigation on Google Cloud Platform
If I Block IP Addresses in Google Cloud Platform and I get DDoS Attack from those blocked IP Addresses, will Google Cloud Handle The Attack Or Null Route My Google VM IP?
google-cloud-platform
1
vote
2
answers
150
views
iPhone OS 11_3 http connection flood
I have been trying to limit max TCP connections to port 80 of my server coming from the same IP. I have used iptables for this task:
-A INPUT -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED -m ...
- 15
0
votes
1
answer
58
views
Fallout from apparent dos attack - httpd trying to contact attacker [duplicate]
I have a server running multiple web hosts (all internally managed) which was the subject of what looked like a dos attack last night. I blocked the attacking IP in IPTABLES for both input and output ...
0
votes
1
answer
2k
views
DDOS attack protection HAPROXY SSL
I'm trying to protect my server from DDOS attacks, my server always have a redirection to the SSL/HTTPS protocol.
but I'm using the next configuration and it's not working
frontend http-in
bind *...
- 123
0
votes
1
answer
537
views
how to stop dns amplification attack from my server
We have dedicated server with centos7. For last 3 days we are receiving Abuse reports that saying 'we detected the following DoS attack with DNS related pattern.' And the source is our server.
How ...
- 1
1
vote
1
answer
548
views
coping with DNS DDOS attack
I have been getting lots of DNS requests for a while, but it would come and go sporadically. Now, it has developed into a DDOS, with several IPs sending traffic at the same time. It was saturating ...
- 21
2
votes
1
answer
455
views
Active Directory is being attacked remotely
Thanks for clicking, I'm having an issue with our server where our Active Directory is being abused by random external servers.
From what I can gather, our server is the victim of an LDAP forwarding ...
- 41
0
votes
1
answer
4k
views
How should I test google cloud's DDOS protection?
I've an application deployed on a Google compute engine, which is being load balanced using Google's HTTPS Load Balancer. And according to this article ,
With global HTTP(S) load balancing, the ...
- 101
-1
votes
2
answers
885
views
Using UFW to completely block internet provider [duplicate]
I am facing a DDOS attack from a few hundred IP addresses, all of them coming from various cities in India and have the same organization: "................ for GPRS Service". (I'm not mentioning the ...
- 119
0
votes
0
answers
456
views
Secure iptables logging against DDoS
My server is blocking all IP addresses except Slovakia and Czech Republic, and I would like to log all other countries and then drop it.
So my rules looks like this:
iptables -A INPUT -m geoip ! --...
- 297
-1
votes
1
answer
908
views
Configure an anti-DDOS on a server with iptables and/or VPN by using OVH's anti-DDOS [closed]
I am hosting my server on my computer at home and I would like to install an anti-DDOS system by using the anti-DDOS managed by OVH. I am actually redirecting my domain name to the IP of one of my OVH ...
- 140
1
vote
1
answer
104
views
How to check if my machine is an amplifier for DRDoS?
My machine has been identified as amplifier for DRDoS attack. How can I trace how my machine has been used to do this and remove the software used?
I tried to check machine's system log but I can't ...
- 223
2
votes
1
answer
6k
views
Is a DDoS possible if the port being attacked is closed?
Let's assume a hypothetical situation in which port 50000 of a machine was being bombarded with UDP packets. However, port 50000 on said machine isn't actually open (i.e. the machine is not listening ...
- 23
3
votes
1
answer
2k
views
NGINX for TCP DDOS Protection
I require a TCP reverse proxy to protect my server's IP. I need something like this which works fine https://xhosts.uk/ddosprotection or https://www.hostsavor.com/proxies
I was wondering if I could ...
- 31
1
vote
2
answers
2k
views
Can TCP Keepalive technique be used to prevent DDOS?
I am learning about DDOS and the techniques to mitigate it. TCP Keepalive is used to check if the other host is still up and if the host does not acknowledge the tcp keep alive message, the connection ...
- 131
1
vote
1
answer
2k
views
How can I protect against Slowloris on a NGINX server? [duplicate]
Well, I recently discovered that my site(s) were vunerable to the Slowloris attack.
A few seconds in after testing the attack on my server just to verify it was Slowloris that was causing the issue, ...
- 11
0
votes
0
answers
55
views
DDOS attack on cloudflare attached server
So I have like 4 Digital Ocean droplets and they all are attached to DNS through cloudflare. The problem is they all are being attackers in different times of month by millions of IPs and some of them ...
-5
votes
2
answers
71
views
Trying to understand something [closed]
So I'm trying to figure something out, if I receive UDP traffic to my server from another server I can't really block it, like the iptables it's just blocking the traffic to being processed, but I ...
0
votes
0
answers
669
views
IIS & NGINX DDOS Protection
I have a Windows 2012 R2 server with IIS currently set up on it and I was wondering what my options were to make this DDOS Protected. I've seen Remote DDOS Protection available from various sites but ...
- 31
2
votes
3
answers
2k
views
routing single ip to multiple reverse proxies
I have multiple servers running nginx reverse proxies pointing to the same ip adress because I need to keep 100% uptime and my service relies on them to hide real ip from malicious attackers and not ...
- 21
2
votes
1
answer
129
views
When an ISP is DDoSed, will its NOC have Internet access?
When an ISP is hit by a huge DDoS attack and its data plane is severely congested, will its Network Operations Center (NOC) have alternative Internet access?
I'm curious what would be the industry ...
- 21
0
votes
0
answers
450
views
convert iptables rules to equivlaent ip6tables rules (CentOS7)
I have the following iptables rules for a CentOS7 web server. I would like to get ip6tables equivalent rules for them. Please let me know, if any changes are required between these and ip6tables rules ...
- 117
2
votes
1
answer
390
views
Nginx - how to log an empty SSL connection with no request line
We are currently under DDoS with the following vector: Attacker is establishing TLS connection then drop off. (No request line is being sent)
This is causing serious CPU load on nginx cluser. We ...
- 135
1
vote
0
answers
41
views
How does DDOS mitigation partners filter out the bad traffic?
I am currently reading about ddos mitigation techniques. I came across a thing called proxy servers and ddos mitigation partners, who can help prevent ddos. The proxy servers actually hide your actual ...
- 131
0
votes
0
answers
924
views
apache2 proxy error - are we beeing attacked / hijacked?
We are getting a lot of load since 2 days on our webserver (apache2.4, wordpress + woocommerce, nodeJS server)
Now I saw a lot of URLs in the error logs which I dont know. Most of them from china. It ...
- 101
0
votes
1
answer
230
views
My web server is being hit, all resources are maxed out, how to find out the root cause?
Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, ...
0
votes
0
answers
48
views
Apache :mod-status shown too larg requests for images directory
I use Apache on my server ,
My server stopped multi times cause too large requests for images directory! (my server not for download images)
different IP and Proxies make this attack ,I can't stop ...
2
votes
1
answer
2k
views
Block direct port 80 access on default IP using iptables?
I am using nginx with cloudflare in front of my sites to protect them from layer 7 attacks but now some attackers found this new way and they are daily attacking my default IP directly with layer 7 ...
- 21
-1
votes
1
answer
1k
views
linux ddos attack and blocking
im checking ddos using this script:
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
it will show something like this
24 220.160.239.126
25 42.80.231.240
26 182.109.15.223
...
- 153
4
votes
4
answers
2k
views
DDoS block source IP at ISP
During a DDoS attack even when you successfully stop it at your datacenter the link between you and your ISP will still be saturated and traffic brought to a halt.
In this case what is the best way ...
- 163
1
vote
0
answers
658
views
Websocket and CDN
I have an application which replies on both http and websocket: it is hosted outside the company server farm.
This application is used both via browser/websocket and, through http, from applications ...
- 111
1
vote
1
answer
3k
views
My hosted server is being used to DDoS using LDAP, how do I stop it?
I recently was told to manage our exchange server because the person responsible left without decent warning. I have next to no experience in this regard, however everything was running smoothly for a ...
- 121
0
votes
2
answers
299
views
About an idea to parry DDoS attacks
Background: I'm building a web application using Amazon API Gateway, Amazon S3, AWS Lambda and so on.
Note: If you don't know about AWS, any pieces of advice would be highly appreciated.
Searching ...
- 103
0
votes
2
answers
187
views
My server is under DDoS. What does this log mean?
Earlier today I got an email from my hosting provider that my server is being DDoSed. I found in log file many suspicious requests with some random site names like dekhockeyvicto.com, workout.de and ...
- 11
-3
votes
1
answer
142
views
under ddos with several search engines [closed]
I am under ddos with several search engines
Any idea how can I stop this?
198.x.x.x - - [04/Sep/2017:17:12:11 +0100] "GET / HTTP/1.0" 302 403 "google.com/results?search_query=i7j0O" "Mozilla/5.0 (...
0
votes
2
answers
464
views
Windows and Apache Block IP by Country
I'm having DDoS attacks and brute force, my clients are only from a Latin American country and I did not find attacks from that country, so I think my solution would be to find a way to block ips from ...
- 3
-1
votes
1
answer
1k
views
How to prevent Source Engine Query DDoS Attack?
I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet(getting thousands of ip addresses sending traffic to a port where a game server is ...
- 1