Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [denial-of-service]

Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

1
vote
1answer
26 views

Sign In Logs With No Client App

We've been having some issues with our Office 365 services, specifically Exchange online. Some of our users are getting attacked from various countries in attempts to get into their accounts. We're ...
0
votes
0answers
18 views

Denial of service attack on a publisher application

I have an application that is bound to a socket which is used only for publishing some data to other applications on the receiving end. I am looking for scenarios for denial of service attacks on such ...
0
votes
1answer
209 views

How should I test google cloud's DDOS protection?

I've an application deployed on a Google compute engine, which is being load balanced using Google's HTTPS Load Balancer. And according to this article , With global HTTP(S) load balancing, the ...
0
votes
1answer
131 views

Mitigating 404 bomb with Nginx

I am hit with 404 queries and this is bringing down my machine. Close to all of my pages are http cached and I have some basic Dos protection with limit_conn_zone $http_x_forwarded_for zone=addr:10m;...
9
votes
3answers
3k views

What's the probable cause for extremely low inbound traffic and high outbound traffic?

Yesterday our Digital Ocean server encountered something that looked like an attack. The outbound traffic suddenly increased to 700Mbps, while the inbound traffic stayed at about 0.1Mbps, and didn't ...
0
votes
1answer
210 views

How can I protect against Slowloris on a NGINX server? [duplicate]

Well, I recently discovered that my site(s) were vunerable to the Slowloris attack. A few seconds in after testing the attack on my server just to verify it was Slowloris that was causing the issue, ...
0
votes
2answers
77 views

Iptables protection against port scanners without DoS vulnerability

Archwiki features an article with suggestions for a stateful iptables firewall. They recommend some rules to trick port scanners, but advise that they open up a vulnerability for DoS attacks. In ...
1
vote
2answers
48 views

Can I uncleanly close a TCP connection, to mitigate a denial-of-service attack?

I work on a web service which could be the target of a denial-of-service attack. We have in place some mitigations against "SYN flood" style attacks. But there are other "application-level" attacks ...
0
votes
1answer
61 views

When an ISP is DDoSed, will its NOC have Internet access?

When an ISP is hit by a huge DDoS attack and its data plane is severely congested, will its Network Operations Center (NOC) have alternative Internet access? I'm curious what would be the industry ...
0
votes
0answers
29 views

One Server Occasionally Takes Down Network/DHCP. How to Diagnose?

We've got an Ubuntu 16.04.3 LTS machine plugged into our network that occasionally needs to automatically reboot itself. About 25% of the time, when it does this, it takes down the entire network. ...
1
vote
3answers
156 views

Ethernet jamming [closed]

I just had a weird experience on my home network. Our ethernet went down; pinging an adjacent host was impossible. I checked the switch; all lights were on and flickering, although they were ...
2
votes
0answers
83 views

How does AWS ELB deals with DoS? [duplicate]

I've seen some AWS documentation about how to mitigate DDoS attacks but this question is exclusively DoS. From the point of view of my EC2 instances, that are behind the ELB, the HTTP(S) requests are ...
1
vote
1answer
166 views

How to Reduce Apache-php Vulnerability to DOS Attacks?

Denial of Service Attacks Denial of service attacks are a common threat to consider when hosting a website on the internet. Although most security vulnerabilities can be prevented by avoiding ...
2
votes
1answer
901 views

How do I contact Google to report network abuse? [closed]

My server is being hit with thousands of connection requests per second from 74.125.170.60. I looked the IP address up on ARIN, and it's in a Google address block. You searched for: 74.125.170.60 ...
0
votes
1answer
501 views

snort rule for rdp dos attack

i am very new in snort rules so i can't find the below rule exactly . is this rule send alert when tcp packets come from external network and any port to home network and port 3389? just check port , ...
1
vote
1answer
895 views

udp flooding prevention using iptables

i want prevent udp flooding so i think if i drop all udps that don't come from the internal network and not relate to a udp connection i can prevent udp flooding. in the other word if only udps that ...
0
votes
2answers
158 views

Rate limiting to Azure VM

Is there a way to add rate limiting to azure VM? We have a VM that generates images dynamically and a few users are abusing it by hitting the server hundreds of times at once. I implemented an ...
0
votes
1answer
446 views

Azure VM DDOS attack via RDP

Yesterday my VM on Azure was under a DOS attack. Symptom was I wasn't able to connect via RDP, unless the server was freshly rebooted, and only for a small fraction of time after the reboot. Once I ...
0
votes
0answers
464 views

Digital Ocean - Outgoing DOS attack

noob here. My droplet has experienced an outgoing DOS attack, as informed by Digital Ocean and networking has been disabled. This has happened twice in the last two days. Previous droplet also was ...
0
votes
0answers
575 views

Network timeouts with CentOS 7 server running in the same network (Syn-Flooding)

As described above, I'm having problems with my network during my CentOS 7 running. When I first encountered problems with my network I tried to permanently run ping on the main router in the same ...
-1
votes
2answers
138 views

Protect against DOS with iptables

Is there any way to protect against dos by analysing how much connection in a port have been done by an ip and not limit the traffic overall? For instance, let's say I don't want an ip to do more ...
0
votes
1answer
465 views

Fail2ban fails to ban (dos attack)

I want to use fail2ban for protecting my server. The http server is a script node that I succeded at formatting the logs like following: 2017-03-18 18:03:32.940 [ INFO ] - ::ffff:192.168.1.56 GET / ...
-1
votes
1answer
97 views

Possible DOS Attack or computer “freak out”

I am a dev-ops web developer with a site running two ec2.smalls behind a load balancer on AWS. Recently we saw 3-4 requests per second take down our clients site. The site was down and would not ...
0
votes
1answer
407 views

nginx rate limit based on location & header of post

Nginx has this useful module called ngx_http_limit_req_module where you can limit requests to the server based on IP or number of requests. Is it at all possible to rate limit the location that ...
0
votes
1answer
142 views

Protect Apache Against DOS

I'm using right the mod_evasive of Apache so I can reduce the probability of DOS. The problem that I had is that the application behind the reverse proxy(which is our server apache) is very weak and ...
0
votes
1answer
588 views

How to mitigate DOS attack on Heroku

I am hosting one of the projects on Heroku Standard 2x dynos plan. Everything was working alright until recently I started to get notifications from our uptime checker that website is down. After ...
0
votes
1answer
503 views

AWS Load Balancer with mod_evasive apache

I have set up mod_evasive and mod_remoteip to change the proxy headers from the load balancer's to the client's actual ip. But I am running into problems when using mod evasive. at the moment, my ...
-4
votes
2answers
60 views

Does it make sense to have a server dedicated to login? [closed]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
1
vote
0answers
97 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
0
votes
0answers
135 views

DNS using GRE work 50%

l'm in a big issue here to make it work I'm already at least about 60% done, but it is difficult and I would like to count on the help guys here who may have already done this type of configuration. ...
1
vote
2answers
25 views

Quantifying site response in case of DOS/DDOS attack tests

Let us say that we need to test a HTTPS web site for vulnerability/response in case of DOS/DDOS attacks. Among other tools, we can use GoldenEye for this purpose. We can vary the number of workers ...
1
vote
1answer
159 views

Long lived TCP connection to DNS servers

Typically the TCP connections to DNS servers are expected to be short lived, ie: the client connects, sends the query and disconnects on getting the response. If a client wants to keep a long lived ...
0
votes
1answer
231 views

Received an email about abuse on our public dns server

We have several virtual machines on a public network due to the ip addresses being public. We received the following email today: We have received the following complaint for xxx.xxx.xxx.xxx. ...
-1
votes
1answer
99 views

How to duplicate a DoS attack

I've a WP blog who have received a DoS attack last days. server start using all CPU and memory, and eventually stop replying http request. It's a POST request to xmlrpc.php, I've checked the content ...
0
votes
1answer
50 views

Network interface fails to come up under heavy traffic

We're investigating an issue with our kit, which is an IP camera running Busybox Linux on a Ti-Davinci SoC. On one particular site there is a lot of network traffic (over which we do not have control)...
0
votes
1answer
574 views

How does CT_LIMIT (the csf firewall setting) work?

I've been wondering if the csf firewall counts the connections for the last CT_INTERVAL seconds and then compares them to the CT_LIMIT value, or it just counts the current (at the moment) connections ...
0
votes
2answers
68 views

Large request body DoS attacks - is this really much of a concern?

Can anyone explain why limiting the maximum request body size is useful for preventing DoS attacks? ModSecurity defaults to 1MB for example with SecRequestBodyNoFilesLimit. I guess I'm wondering ...
1
vote
2answers
91 views

Is it normal for a VPS provider to claim DoS attacks often? [closed]

I have been using a well-known VPS service for over an year. Everything is good except one thing that once in a while, there will be some DoS attack. And when it happens, my server becomes ...
0
votes
2answers
1k views

Should I expect reception of packets in hping3 --flood?

I'm testing a newly purchased VPS for DDoS vulnerability using hping3. If I do not use --flood, everything goes fine and I see close to 0% packet loss every time. But If I do use --flood, then the ...
2
votes
1answer
824 views

Nginx too many open files DDOS

Im having an issue with ddos at the moment. My web server is behind a reverse-proxy (cloudflare), which I know shouldn't be relied on with their free plan. Cloudflare is in under-attack-mode, which ...
1
vote
2answers
4k views

How do I stop a simple DDOS attack?

There is a hacker who is mad at us, and has started a DDOS attack against us. I think he is a script-kiddie, using tools like DarkComet; the attack is probably simple. I host a server on my PC. The ...
-2
votes
3answers
161 views

Use two or more IP addresses to prevent DoS attacks [duplicate]

N00b question But say I had a dedicated server with two IP addresses, and the software (We'll just use Apache as an example) was using both IP address to serve content, in the event of a DoS attack ...
1
vote
1answer
133 views

Frequent SIGTERM Apache [closed]

I suspect sometings is going wrong in my webserver (maybe possible DoS attack). In fact I see a lot of such entries: [Sun Jul 19 10:36:21 2015] [error] [client 141.212.122.18] client sent HTTP/1.1 ...
0
votes
1answer
1k views

Mod_evasive not blocking a DOS attack using HEAD requests

Using Apache/2.2.15 on RHEL6 with mod_evasive config: DOSHashTableSize 3097 DOSPageCount 14 DOSPageInterval 2 DOSSiteCount 70 DOSSiteInterval 1 DOSBlockingPeriod 60 ...
1
vote
1answer
143 views

Google App Engine's blacklist not listing top IP addresses

I'm dealing with DOS attacks at the moment and could use a hand. In the past, App Engine would show the top IP Addresses hitting an instance on https://appengine.google.com/blacklist, but it's not ...
-3
votes
2answers
243 views

How to stop a cmd/ping flooder [closed]

I banned a guy from my site for breaking rules and he mailed me saying he will cmd flood/ping the site until I unban him. He's been bringing the site down for three days now. My site is with a ...
1
vote
1answer
196 views

Is it possible to bring down a network with DHCP discover?

When a DHCP server receives a DHCP discover message it broadcasts the offer across the entire network. If a malicious machine joined a network and somehow began spamming DHCP discover messages, would ...
3
votes
2answers
729 views

Weird Requests Being Sent to My Server [duplicate]

I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my ...
0
votes
1answer
649 views

How can I tell if a cisco router is dropping pings due to DOS suspicion or if it's experiencing packet loss?

We use a PRTG server that's connected to a cisco 6500, which feeds a large network of about 1200 switches and radios in a router-on-a-stick topology. In PRTG I'm able to set a 'ping burst' sensor on a ...
1
vote
1answer
1k views

Benefits of separate firewall product over AWS Security Groups for spam requests

I have a question that is an extension of this one: Examples where an AWS Security Group is not sufficient as a firewall?. Initially, the answer in that question made sense to me and I was working ...