Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [flooding]

73 questions
0
votes
0 answers

running snort and IGMP v2 flooding

I am not a network guru so please bear with me. I am running snort on a PLC (running rt-linux) along with an application that needs to communicate with another instance of the same application residing on another PLC, via multicast. I have…
awatan
  • 101
  • 1
  • 4
0
votes
1 answer

opnsense disable anti flood

I've just installed OPNSense; it's working ok, I can have traffic in/out, but when trying to use a sustained stream such as rtmp, it stops after a few kB. If I disable the firewall, the stream goes on, so I guess there is some kind of flood…
greg
  • 169
  • 11
0
votes
0 answers

Nginx flooded by IP address that's not going away

We are using nginx and seem flooded by an IP address that that's not going away even after putting it in firewall and usng tcpkill. $ netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head 22…
Mugoma J. Okomba
  • 173
  • 3
0
votes
0 answers

Network timeouts with CentOS 7 server running in the same network (Syn-Flooding)

As described above, I'm having problems with my network during my CentOS 7 running. When I first encountered problems with my network I tried to permanently run ping on the main router in the same network. The ping request produced Request timeout…
patvax
  • 151
  • 1
  • 4
0
votes
1 answer

High Traffic from Content Delivery Networks

I am having trouble on our school network recently. When browsing the internet users will often get an error from the browser saying "No Internet DNS_PROBE_FINISHED_NXDOMAIN" but when they refresh the page will load. I at first suspected our dns…
Joel Page
  • 113
  • 1
  • 1
  • 6
0
votes
1 answer

Fail2ban block on destination ip address

I have a server listening on multiple public ip addresses. When a certain situation occurs I want fail2ban to ban only on the specific ip address where the connection is attempted and not on the whole server as it does by default. I tried looking on…
Romeo Mihalcea
  • 522
  • 1
  • 9
  • 27
0
votes
4 answers

How to avoid floods like this?

Instead of describing what's happening I'll post a screenshot of Apache's server-status page: Screenshot It is a Nigerian IP. I'm having this problem for years now and I never found a viable solution except banning the attacker's IP and waiting for…
janosrusiczki
  • 103
  • 1
  • 5
0
votes
1 answer

How to prevent TCP network flood triggered by KVM VPS clients?

How to to protect nodes/ detect and block KVM VPS clients that TCP flood the network ? I use SolusVM VPS management system. Recently one abuser toke several VPSs and flood it the datacenter network. Luckily I manually found him but I need some…
Blazer
  • 77
  • 2
  • 6
0
votes
1 answer

What is the best way to harden a postfix null client on an exploited php webserver?

We use postfix as a null client to send out mail from a php webserver via sendmail. We host our incoming mail servers elsewhere and use a SPF record to authorise the server to send emails from our domain. This all works. Now I would like to harden…
Phil
  • 157
  • 7
0
votes
1 answer

Check if a constant file request is flooding the server

I'm new to this sort of thing so forgive me if I ask anything stupid. I am using moodle (open source LMS), it has a feature where you can upload a scorm package which requires a reliable internet connection for reporting to work. Therefore it has a…
David North
  • 11
  • 1
0
votes
1 answer

Strange TCP Flood / Flood from Port 445

Good Evening. Today I noticed a strange flood on a box that I am working with, here is a dump from tcpdump: 23:21:07.580917 IP (tos 0x0, ttl 64, id 5746, offset 0, flags [DF], proto TCP (6), length 94) f125.wedos.net.microsoft-ds >…
David Bernard
  • 1
  • 1
0
votes
0 answers

GET /wpad.dat entries flooding my access_log

I have a small LAN of some 30 users in it with proxy auto configuration enabled and working. Two of them are requesting wpad.dat file too rapidly at a pace of 30 times per second. 10.1.14.246 - - [02/Jun/2014:09:07:18 +0200] "GET /wpad.dat HTTP/1.1"…
Aas
  • 308
  • 1
  • 4
  • 10
0
votes
1 answer

How to detect malicious script in my CentOS server?

I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it. Here's the detail my provider sent me: Where can I find the logs that record all of these attack in my…
WoooHaaaa
  • 1,605
  • 4
  • 15
  • 13
0
votes
2 answers

iptables rules for botnet (UDP flood) protection

I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in iptables, but none of them seemed to work. I'm on…
Petar Simeonov
  • 1
  • 1
  • 2
0
votes
4 answers

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. Initially I suspected the server was dos attacked and…
Daniel
  • 23
  • 1
  • 5
1 2 3
4
5