Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [flooding]

73 questions
2
votes
3 answers

Network flooded with seemingly empty packets

Let me preface this with the fact that I'm just a web developer at my company with little networking knowledge. Earlier today there was a department that lost all of their network connections so I popped open Wireshark and observed the influx of…
Adam Particka
  • 139
  • 1
  • 2
2
votes
1 answer

Windows Server 2008: Limit UDP/TCP packets per IP or ban

How I can limit UDP/TCP packets per IP send to my host (or better PORT) per second or minute ? Would be nice to ban that IP for 12/24 hours or even for ever. I got Windows Server 2008 and I'm very poor in Windows administration but quite good in…
WBAR
  • 71
  • 1
  • 6
2
votes
1 answer

Mitigate HTTP connect floods with HAproxy + Apache

Our infrastructure consists of load balancers running HAProxy and Apache, which forward traffic to our app servers running just Apache. The past few days, we've been seeing connection floods which the load balancers happily pass along, but the…
Christopher Armstrong
  • 236
  • 1
  • 8
2
votes
1 answer

Packet flooding, is there any way to handle it?

My machine is being flooded with thousands of packets per second. They don't eat much bandwidth (60mbps out of 1gbit) but they damage system a lot by consuming a CPU responsible for handling network card interrupts. ksoftirqd goes to 100% and…
rfire
  • 41
  • 1
  • 4
2
votes
2 answers

How to remove route with IP?

Used to ban some flood-bots with route add -host $ip reject But couple of 'good' IPs were banned as well. My question is stupid (but I've searched and found no good solution (all were large and/or didn't work)): How to unban it if I know the IP…
ABTOMAT
  • 181
  • 1
  • 1
  • 10
2
votes
3 answers

Causes of UDP Flood

This is part of a mail that I received The IP 69.89.6.235 is attacking our server at 94.23.204.191 and 87.98.168.239.80 with UDP flood. I have a newsletter scripts that I use to send newsletter to a lot of emails on my site (with IP 69.89.6.235).…
yankitwizzy
  • 163
  • 1
  • 2
  • 9
2
votes
1 answer

Protecting against UDP flood

One of my servers is being flooded with udp packets on random ports. 12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1 12:11:54.190447 IP 182.48.38.227.60173 > localhost.23769: UDP, length 1 12:11:54.190560 IP…
Balon
  • 145
  • 1
  • 8
1
vote
2 answers

Too much ARP 60 Packets and Network is getting very slow

I am seeing too much ARP 60 packets from one IP in wireshark. Our LAN is getting too slow, But the internet is working fine without any issues. But cant access local printers, file share etc Am attaching the image with this. Is it normal to have…
Muneeb K
  • 111
  • 1
  • 1
  • 3
1
vote
0 answers

SYNPROXY doesn't seem to be running

I have attempted to create iptables rules to prevent my server connections limit to be filled up with in-completed SYN packets for which no ACK packet is returned by the client (SYN flood attack). I have read the [RFC 4987 TCP SYN Flooding Attacks…
I'm Root James
  • 212
  • 3
  • 13
1
vote
0 answers

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ton of TCP and UDP attacks in the past yet it fails…
Yannick
  • 119
  • 2
1
vote
1 answer

Strange NetBIOS query with old computer name

I've one computer in our network which I first named PC029. Shortly after I changed its name to PC021. This was more than a year ago. Today I've found (thanks to Wireshark) that this computer is flooding the network with NetBIOS and LLMNR queries…
Farlop
  • 193
  • 1
  • 1
  • 7
1
vote
2 answers

Finding Evidence of a Denial of Service Attack (Linux)

We had a Gentoo Linux server (that was updated weekly or bi weekly) that higher ups claimed did a denial of service attack on the whole local network and brought it down. Are there any log files we can look at to see evidence of this? We don't have…
bobber205
1
vote
2 answers

Firewall UDP Flood Dos/DDoS

Recently I have been suffering from what appears to be a UDP query flood attack. I am looking for a way to block the attack using a software firewall such as iptables, this should be possible, as explained below. The target of the attack is a GTA…
Bill Boverhaven
  • 11
  • 1
  • 2
1
vote
0 answers

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well with SYN packets generated from raw socket, but not…
Franzz
  • 11
  • 2
1
vote
0 answers

ntopng: Host XXX.XXX.XXX.XXX is a flooder [NNN new flows in the last 3 sec]

I am exploring ntopng reports on my router and seeing, that one computer on my LAN is a flooder. ntopng says Host XXX.XXX.XXX.XXX is a flooder [NNN new flows in the last 3 sec] How to explore these flows in more detail to know if they are legal or…
user102132
1
2
3 4 5