Questions tagged [flooding]
73 questions
1
vote
0 answers
Network flooded with LLC packet
Recently my network has been slow. From Tcpdump i found lot of frame with protocol LLC. A complete packet capture can been here tcpdump result
Any hints on interpreting these packet?
riizzz
- 11
- 1
1
vote
2 answers
Protection against scrapping with nginx
This morning we had a crawler going nuts on our server hitting our site almost 100 times per second.
We'd like to add a protection for this.
I guess I'' have to use HttpLimitReqModule but I don't want to block allow google/bing/... How should I do…
bl0b
- 141
- 1
- 6
1
vote
2 answers
Stange stream of HTTP GET requests in apache logs, from amazon ec2 instances
I just had a look at my apache logs, and I see a lot of very similar requests:
GET / HTTP/1.1
User-Agent: curl/7.24.0 (i386-redhat-linux-gnu) libcurl/7.24.0 \
NSS/3.13.5.0 zlib/1.2.5 libidn/1.18 libssh2/1.2.2
Host: [my_domain].org
Accept:…
Alexandre Boeglin
- 13
- 2
1
vote
1 answer
sudo passwd on Ubuntu 11.10 strange behavior. Have I been rooted?
I'm in a really strange situation. A few hours ago Rackspace issued a ticket saying there's a outbound flood originating from my server.
Thinking the server might have been rooted with a rootkit I ran chkrootkit scans and nothing showed up.
So I…
qwexar
- 111
- 2
1
vote
1 answer
UDP flooding multiple servers
Possible Duplicate:
What are the best techniques for preventing denial of service attacks?
What do you suggest?
Being UDP flooded as I write to multiple servers in different data centers in 5 different countries . Up to 250,000 packets a second.…
Chris Gurney
- 11
- 2
1
vote
1 answer
Why is FunWebProducts flooding my server?
I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible?
89.70.25.120 - - [03/Sep/2012:07:19:12 +0200] "POST /user/login…
giorgio79
- 1,837
- 9
- 26
- 36
1
vote
2 answers
Monitor incoming TCP/UDP flood attack and graph it
I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results.
I have some VPSes that will perform a tcp or udp flood attack simiultanesly on another…
Ion
- 278
- 2
- 3
- 10
1
vote
2 answers
VPS under DDoS Attacks
Possible Duplicate:
Am I getting DDoSed, and what should I about it?
I'm using a 2 VPS Servers.
My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was realy slow.
I have contacted the hosting company and they…
Seik
- 73
- 2
- 6
1
vote
4 answers
How can I prevent apache DoS flood?
I've configured a server running apache and a couple of days ago I noticed in the logs that there are bots running endless queries to the site. The logs show that those bots are running about 60 queries per second for about 20 minutes coming from…
tftd
- 1,498
- 7
- 25
- 40
1
vote
1 answer
How can I recognize flooding?
how can I discover if my server is performing some illegal actions, like flooding?
user48058
- 863
- 3
- 12
- 20
1
vote
2 answers
UDP Flood/DoS or What?
Basically
I am receiving a lot of packets/data with random info on UDP protocol.
Packet has header and then a lot of XXXXXXX in it's content.
I assume it is UDP flood but it comes from different web/dedi hosting companies.
Also this basically uses…
DanSPd
1
vote
2 answers
Monitoring traffic on linux router for syn-flood
We have a linux server (Debian-Lenny) with solid-state drive, without hard disk classic. He's use as a router, so traffic is only for forward.
We want to monitor connexions in able to find some syn-flood. Netstat could help us, but we have many…
Matthieu
- 66
- 3
1
vote
0 answers
how can i block/ban an ip after a number of rejects on a mail server?
I found several attempts to use my email server as relay. The helo command was not coming from a FQDN and therefor the request got rejected.
Is there a way to ban an IP address complelty after a number of "malicious" attempts without sending a…
zippy-flop
- 21
- 4
1
vote
1 answer
Block SYN,ACK response with iptables
I have a virtual environment and Iam making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.
I realized that a countermeasure for this attack is to limit or block the responses to the SYN packets, which are the SYN,ACK.
But how can I…
user568948
- 11
- 3
0
votes
1 answer
iptables ... -j DROP appears to leave connections open?
So forgive me if this is a dumb question, I'm not much of a networking expert. A friends server is being flooded by a certain IP, which is pretty obvious when looking at the output of tcptrace, as there are hundreds of connections with state…
DarkWiiPlayer
- 103
- 2