Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [ddos]

A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.

For information on what to do about a DDoS attack that is underway, see How can I stop a currently active DDoS attack?

624 questions
0
votes
2 answers

Detect process that is doing an outbound DDoS attack

My web host has informed me that my Fedora server is the source of an outbound DDoS attack on somebody. The web host didn't give any other information. How can I find out what process is doing the attack so that I can stop it? I realize this is…
Jason
  • 1
  • 1
  • 1
0
votes
2 answers

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost programs and intranet clients in a way, I don't fully…
David162795
  • 145
  • 2
  • 9
0
votes
2 answers

netfilter ip_conntrack and (d)DoS

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps or just makes the attacks worse by bogging down…
Tiffany Walker
  • 6,681
  • 14
  • 56
  • 82
0
votes
2 answers

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto UDP…
Marcel
  • 3
  • 1
0
votes
2 answers

Determine packets per second

What is an ideal way to get the number of packets per second on a Linux box? Would I use tcpdump or are there better methods?
Tiffany Walker
  • 6,681
  • 14
  • 56
  • 82
0
votes
1 answer

How protect from DDOS attack?

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET /topic?criteria=%&x=0&y=0&pageNo=34 HTTP/1.1" 403 571…
Dmitro
  • 159
  • 1
  • 5
  • 12
0
votes
1 answer

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses about 75% ram and seems to be crashed in some way,…
ltsstar
  • 111
  • 1
  • 4
0
votes
1 answer

My site is inaccessible from different locations on-and-off. What's happening?

On-and-off for the last few days, my sites (www.)aderet.org and to a lesser extent (www.)saveadullam.org have been down from (two different networks in) Israel. Over a period of minutes or seconds, they can go up and down. A test at…
Joshua Fox
  • 239
  • 2
  • 8
0
votes
1 answer

Server Recovery from Denial of Service

I'm looking at a server that might be misconfigured to handle Denial of Service. The database was knocked offline after the attack, and was unable to restart itself after it failed to restart when the attack subsided. Details of the Attack: The…
JMC
  • 506
  • 6
  • 23
0
votes
4 answers

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. Initially I suspected the server was dos attacked and…
Daniel
  • 23
  • 1
  • 5
0
votes
1 answer

DDoS attacks to PBX

I'm wondering if DDOS attacks to PBX or telecommunications systems is possibe real. According to this…
Delmonte
  • 301
  • 1
  • 7
  • 19
0
votes
1 answer

*Simple* way to block DDoS by number of requests

I have 3 Varnish 3.0.2 servers with Apache 2 as backends, which are being load balanced through a HAproxy separate server. I need to find a very simple program (I'm not much of a sysadmin), which blocks requests from an IP, if that IP has made more…
Eduard Luca
  • 371
  • 2
  • 9
  • 19
0
votes
1 answer

mod evasive not working properly on ubuntu 10.04

I have an ubuntu 10.04 server where I installed mod_evasive using apt-get install libapache2-mod-evasive I already tried several configurations, the result stays the same. The blocking does work, but randomly. I tried with low limis and long…
The Shurrican
  • 2,240
  • 7
  • 39
  • 60
0
votes
1 answer

DNS workaround for webhost DDoS

My webhoster seems to have some troubles with DDOS attacks and routing overload. This makes my IP to be not available sometimes and I'd like to add a failover IP for the domain. However, 2 A-Records means that it's similar to a load balancer which…
ledy
  • 565
  • 1
  • 6
  • 15
0
votes
1 answer

How to know which site/script is taking all CPU and RAM in Plesk/apache

I have more than 100+ domains on a CentOS Plesk server. Suddenly the load on the server goes very high and eats up all resources. eating up all RAM, all CPU , due to which i cannot even login to server to check that what is happening to server. I…
Farhan
  • 4,269
  • 11
  • 49
  • 80
1 2 3
…
41 42