I want to understand the Idea of DDOSING
If I have a server with a a gb /second port so no one can DDOS me ?
or if the hacker have a servers with a gb/ port he can destroy any thing ?
second question
sometimes people hjave ip tables to filter all the packets to the server these people some times go down for ddosing too WHY ? why the IP tables cant filter the packets of this type of DDOSING?
I don't have raid in my dedicated box as it's usually way more expensive. Instead I have two drives. I use one for OS/data and one for backups. I do nightly backups to the disk. I also do 3 weekly off site backups to my home server. So as far as backups I'm safe.
Now the issue is if the disk fails then my server is down. Do lot of people take this risk in order to save money? (often 50-100 per month)
In people's experiences, how long does it typically take for a data center to put in a new drive and load the OS?
In a 3+ disk server I'd use software raid for the data but the OS would still be alone.
Do lot of people do this?
With 10 servers, that's a lot of money saved for a small enough risk.
I am considering signing up for a very well-received host on this site and around the net. It is DowntownHost. They have a promotion right now where you can get 25% off for life. They have tiered plans. So you if you pay for 1, 2 or 3 years upfront, for example, you will be paying *a lot* less per month than if you paid just monthly. Add in this 25% off promotion, and you can see some big savings.
Now, for most hosts that you haven't tried, I would say no way commit your money for a year. But DowntownHost's reputation precedes them so well, this could be an exception.
Plus, they have a 90-day money back guarantee where you would get all your money back if you don't like the service.
So my thinking is that I should no whether or not I am going to stick with a host within 90 days. That is plenty of time. But, then again, your money is tied up for 1, 2 or 3 years after that 90 days, and if something goes wrong, you are up a creek without a paddle. Plus, I have heard (in general, not with DowntownHost specifically), that your support level could decrease after your trial period if you have paid for an extended plan because, well, they have your money, so what do they care.
What are people's opinion on this?
I'm interested in creating a small website exposing the biggest overselling companies, and how their overselling practices are false marketing.
Simply put, I want to benchmark each host with exact tests for accuracy. Any idea how I can fairly test each host, e.g. benchmark?
After the tests have been performed, I will explain which are the worst hosts (e.g. the first to give me the boot due to some TOS clause, e.g. cpu usage), etc.
Also, would anyone like to help out with this project? I'll be putting some nice marketing into it.
I was just working on some concepts for image upload security features and wanted some others opinions. Would the below be worth doing to not have to deal with the 777 or even 775 phpsu issue(s)?
- What about loading the images into a db and logging the upload. Then having a cron or a daemon move the file to a location under the owner (user) and then delete the file out of the db.
Pros:
- Images would be loaded and displayed from under the user of the site making no 777 issues.
Con:
- Mass use of db could cause crashes?
- Would have to write front end to know if the file was in db or in the folder location
telling me about your offerings, or trying to convince me about out of area datacenters because of the risk of terrorism, cost, or alien invasion, I'm not seriously shopping around, just doing a bit of initial research.
With that disclaimer, what's a rough expectation of pricing for a NYC, carrier neutral datacenter for 1 cabinet with 60 amps of 110v? Preferrably somewhere that Internap is available.
it's come under my attention that dragonara.net has been ddosing me today since morning from the ip:
194.8.75.229
What's so ironic about it is that the ip is from a UK DDOS protection site so i'm expecting some email with their services in the next hour or so. Stay clear of them they are fakes and e-terrorists.
I've got a 256mb cpanel vps and since I use enom's dns for all the domains going to the server, could I actually disable named (Berkely Name Server Daemon BIND) and get back 64mb ?
View 5 Replies View Relatedwe have one box in hivelocity.net that has been down so many times this month that we were forced to remove links to siteuptime where we were once so proud of having a 99.7% uptime for 3 years in theplanet.
syslog shows that just before crashing, these entries were made:
kernel: kernel BUG at mm/rmap.c:479
kernel: invalid operand:0000 [#1]
dmesg also shows this:
...
Brought up 2 CPUs
zapping low mappings.
checking if image is initramfs... it is
Freeing initrd memory: 482k freed
NET: Registered protocol family 16
PCI: PCI BIOS revision 2.10 entry at 0xf9f20, last bus=1
PCI: Using configuration type 1
mtrr: v2.0 (20020519)
mtrr: your CPUs had inconsistent fixed MTRR settings
mtrr: probably your BIOS does not setup all CPUs.
mtrr: corrected configuration.
...
i've googled these messages and they point to ram problems.
hivelocity.net claims to have done diagnostics on the box and that there were no problems reported.
they said this is a result of a sys configuration problem made by us.
any ideas?
I am looking for some good ddos protection providers, via protected dns. I've searched on internet, but most of them are really expensive.
Please tell me some ddos protection providers what could help me.(gige is too expensive btw).
And I found some ddos protection scripts. How can a script protected a server from ddos? A sript like CSF or DDoS deflate?
I've been getting VERY high packet loss to my VPS for around 10-15 minute periods over the past month or so (No patterns or specific times, totally random when it occurs) with my provider's Parallels Business Automation control panel reporting "Server is down" along with the VZCP on the node being inaccessible. I opened a ticket with my provider and they told me that they experienced a DDoS attack on the node my VPS was hosted on.
However, I get the feeling that they are giving me some crap to stop my pestering them about the packet loss all the time (I mainly use my VPS for providing VoIP services which use UDP so the packet loss is devastating).
Anyone got any views on this?
Also they keep offering to move me to a diffrent node but they say they can only do that by giving me a new IP address and I would have to backup all the data and restore it manually, myself. Any views on this as well?
I'm experiencing a significant UDP DDoS at the moment which is aimed at port 80 on my server, it's currently crippling Apache, but only on port 80, https (443) is fine. I've told iptables it drop UDP packets sent to port 80 and have also completely blocked most of the attacking IPs, this has helped, but the webserver is still periodically unresponsive.
View 11 Replies View RelatedWe are getting ddosed badly.. Last night httpd reached max clients and httpd wasnt able to start up.
View 3 Replies View Relatedwe had a bad ddos to on of the sites we were hosting, the ip of the ddos was blocked in apf and iptables, but for some reason it still got through we had to have it blocked in the router, we installed CSF into our server hoping for a better firewall does anybody know why apf could not hold back the ip im open to suggestions,
View 2 Replies View RelatedI have got pretty big problems with my VPS, some of my sites getting DDoS'd a log. I have no idea why and who DDoSing them
I have csf, apf and DDoS Delfate installed but it seems they can't take those attacks down. I know for mod_evasive but it works only on small attacks, I getting pretty strong attacks
I need some way to configure csf better, what I need to edit in /etc/csf.conf to block IPs if the same IP trying to connect to server more that 10 times. I need everything what I could edit for csf to block IPs faster
About DDoS Deflate, he is configured to works with apf, can I configure it to works with csf and how? How to configure DDoS Deflate better, to block IPs faster
Also, another problem with csf is that when I restart csf(service csf restart) he unblock all blocked IPs and I have to block them again
How to see blocked IPs by iptables?
I running lighttpd at the moment but I thinking to change it with Litespeed(free edition), what do you think about it?
I hope I will get some help here. Aslo,would be interesting to hear how do you guys protecting your servers from DDoS(if you getting DDoSed
we have a 100mbut connection and with a normal traffic we use about 40-50mbit but from friday seem that we are under attack this is the stats from the fastethernet
inbound 20427 ucast pkts/s
outbound 5547.5 ucast pkts/s
inbound 85793.9 Kbit/s
outbound 8211.98 Kbit/s
we have reach also for 4 hours 100mbit and all the server was offline, we have contact the datacenter and they say that not is a ddos attack because the traffic come fom our server and not from outside the net, so look as we have a hacked server that is making all this traffic, how can w found the problem? we have about 130 server on this connection
If you were under a DDos attack, what commands would you execute to confirm this?
Is it normal for high traffic sites with 3,000 concurrent apache connections from running this command?
netstat -n | grep :80 |wc -l
what would happen if you changed the server IP to 127.0.0.1?
View 4 Replies View RelatedMy server is using too many httpd process..I think iam under DDOs attack..I executed the following command..
netstat -an | grep :80 | sort
and the result is this
tcp 0 1491 ::ffff:95.211.10.169:80 ::ffff:213.215.100.110:2263 LAST_ACK
tcp 0 1493 ::ffff:95.211.10.169:80 ::ffff:85.207.126.231:52694 LAST_ACK
tcp ....
The DC installed Squid. It manages the load fine but the php code on my page is cached and doesn't work.
Is there a way to get squid to not cache php? in that httpd can directly call php while squid does everything else?
Hey guys If there was a way to have the ips of the dedi change constantly would this help prevent ddos attacks or would there be no difference if the domain was being attacked.
View 2 Replies View RelatedOK well today I found out my server was being DDOS'ed
And I know which domain is being attacked with hundreds of IP's. I am running Cpanel / WHM but I have no idea how I can stop this?
Any ideas or suggestions? Maybe redirect the DNS? to a invalid ip? But I'm not sure how i can go about doing that?
I have a problem with a customer. For the last 48 hours he has been receiving a massive DDoS at his server. I tried blocking the darn IPs but they keep coming and with several hundreds of connections each:
104 78.157.168.98
125 83.226.157.91
126 89.103.109.65
131 89.12.150.23
135 84.251.196.78
135 86.122.0.135
135 91.127.235.86
154 84.24.14.41
160 193.216.140.101
331 89.151.8.78
419 78.0.103.64
Apache has over 14000 connections. I tried using mod_evasive but didn't do anything and the server has been out without httpd for hours now. Any advices? This is a Hsphere server (I hate it personally) with 4GB RAM and a dual optero 246. I have the mexclients setting at 550.
I have a windows server, and today it has a large inbound traffic, so I tried to disable all web service, and after that, the result of netstat -an shows no connection at all, but the server still has large inbound traffic,
Do you have any idea about this?
What should I do now?
Our server is in attack since 4 days. Http port busy all the time.
When I type :
netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut -d: -f1 | sort -n| uniq -c | sort -n | tail -5
It shows :
[root@ ~]# netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut
-d: -f1 | sort -n| uniq -c | sort -n | tail -5
2 65.19.130.24
2 83.149.120.9
4 204.15.73.243
35 222.254.103.142
5128
[root@ ~]#
I wonder the hidden IP of 5128 ??? How to know it?
A user joined our live chat and said if we didn't cancel a domain on our server, he will send us a DDOS attack, and he did so and also did this morning.
Is there anything I can do to prevent this or possibly punish him?
The server getting slow with high I/O diskwait then normal, although load is not high.
here is the output of: netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n .................
My server is getting ddossed everyday, all are at the same time -> 4 am since tuesday.
Cacti is showing 60~70mbit on that time.
Server 'crashed' on thursday (nearly 70mbit), it got back up but the ips (4 out of 5) were not working. Couldnt ping it. So I gave it a reboot and it worked again.
I used to get alot of Brute Force attacks, after I changed port and not allow root login etc etc on Monday, I dont get any attacks anymore ...
i had installed anti ddos or firewall,but those are useless.His attacks are such great that The server and all the vps are down now. One told me that I should check the ips and receive ips. The attacker is so skillful .describe the best method to defeat him. Be sides the attacker use diffirenet ips in each attack,I block him by iptables but no use…. His attack occupy all the ram and I have to resetart the server… Now this time his attack lead to shutting all the vps down
View 10 Replies View RelatedMy website is under ddos attack from some competitors. I don't know yet how big is the attack. The ips of the ddos attack come from all the world.
I have contacted a few hosting companies specialised in ddos proof hosting, unfortunatly the price is so expensive that i cannot afford it.
So i try to find another solution : my website is only aimed to the french people, so maybe is it possible to install a kind of firewall or proxy located before the server to block all the incoming IP adress not from france ? Do you know some websites who can do this and the price ?
I already try do deny the non-french ip in one htaccess file but the ddos attack saturate the server anyway.
i'am looking for a software based ddos protection,some one know something for try to mitigate a ddos or help to get the server rock a solid?And i need to know too where i change the DNS(vhost) of my DEDICATED server.
View 4 Replies View Related