I have been in online business for about 5 years, but only this morning found out what DDoS is. Shame on me.
Our site was attacked this morning and the host (shared hosting) has switched off the dns connection so our site is currently down along with email. We are a small firm and we are absolutely getting killed by this right now.
The tech support in this hosting company (icdsoft com) is absolutely phenomenal based on previous experiences and here is what they said throughout the day:
"Your site gets approximately 60 hits/second. Unfortunately there isn't much that can be done in such situation. We already blocked the most active IP addresses in our firewall, but this does not help, as the attack comes from many sources "
About an hour later they tried again and the following was said:
"Unfortunately we do not know how long this attack will last. At the moment there are more than 1100 requests/second towards your site."
about an hour after that the following was said:
"The attack is still going on. Currently, the incoming rate is 8MBit/sec. We will enable your site, and we will notify you when the attack is over."
My questions are the following and I will appreciate any advise as I am absolutely clueless about this:
1. What should I do at this point? Should I move the site to a dedicated server and if so, will this solve the DDOS problem?
2. Should I purchase anti DDoS package? They are extremely expensive it appears.
3. If I move to a new dedicated host, which one should i choose? we are a small site, with about 10,000 uniques per month and do not have massive budget so cost is a big factor.
4. How long will this current attack likely last? I know it's impossible to answer, but approximately how long do these things last and is it likely to repeat in the future if we leave things alone?
Any knowledgable advice on this matter will be greatly appreciated as we are hurting badly due to this and even 1 day loss of income for us is extremely serious and hurtful.
I have a windows server, and today it has a large inbound traffic, so I tried to disable all web service, and after that, the result of netstat -an shows no connection at all, but the server still has large inbound traffic,
i had installed anti ddos or firewall,but those are useless.His attacks are such great that The server and all the vps are down now. One told me that I should check the ips and receive ips. The attacker is so skillful .describe the best method to defeat him. Be sides the attacker use diffirenet ips in each attack,I block him by iptables but no use…. His attack occupy all the ram and I have to resetart the server… Now this time his attack lead to shutting all the vps down
My website is under ddos attack from some competitors. I don't know yet how big is the attack. The ips of the ddos attack come from all the world.
I have contacted a few hosting companies specialised in ddos proof hosting, unfortunatly the price is so expensive that i cannot afford it.
So i try to find another solution : my website is only aimed to the french people, so maybe is it possible to install a kind of firewall or proxy located before the server to block all the incoming IP adress not from france ? Do you know some websites who can do this and the price ?
I already try do deny the non-french ip in one htaccess file but the ddos attack saturate the server anyway.
I am seeing DDOs from past two days, I believe its, but I can't find out which type of ddos it is...Whenever I shutdown apache the load goes down, if I start apache the iowait time goes extremely high and after few minutes the server is not responsive...the server is dual cpu quard core...please help me in finding out wuts happening, the softlayer guy is looking into the issue, but I am not getting any good response
Yesterday my server suffered a DDoS attack - at least, I'm assuming that's what it was, as incoming traffic rose to 100mb/s for a period of about 20 minutes. The only solution was to shut the server down, then bring it back. Fortunately, the traffic did not return.
At the time, I couldn't even access the server as root. The datacenter has been unhelpful, telling me that they have no idea where the traffic was coming from. What can I do to find out what happened, ideally an IP (and what kind of data was being sent)? I'm running RedHat Enterprise Linux.
my server is dead from thursday night the site has gone offline well the backend works justwhen you go to a domain it just doesnt open ive run a few commands in ssh heres the results
i run netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n and i get this
We are getting more traffic to one of the servers. It seems like DDOS attack, but IPs are diferent. I want to find what IPs are connecting more connections. Are there any commnds? I want to block those IPs.
Someone is trying to attack our server (I think so). When running apache status there are a LOT of connections from one network, all requesting the same page. But running: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n does show any of these IP's. So script blocking ddos attacks wont work. Anyone know what can I do about this?
Im currently with poundhost i have some colo servers with them
they have gone down 3 times over the last week 2 DDOS attacks and 1 router/exchange issue
I called them up and they reckon they get 1 DDOS some weeks, and other weeks have none
However, when another server is getting a DDOS attack, i dont want my server to go down. I take it the network pipe is being flooded, and thats why websites stop responding.?
so i called rapid switch, they reckon if they get a DDOS attack, it just takes down the one server, and not everyones elses
I have a dedicated server running Debian and i am having some problems with Apache using a lot of CPU causing the load to go about 100.00. My load is usually 0.50 so this is not a bad coded script that is causing the problem.
I run netstat and got the following results ( my server IP has been replaced ):
The problem is probably those close_wait connections. I already have APF installed on my server ( althought it doesn't work well with Debian ) and only port 80 is open.
how can i stop those attacks? Besides manually blocking the ip, which is not the best way to handle this problem.
is there any proved method to determine what kind of attack you are under? Our server has been under attack for more than a day now but so far we have not been able to find out what kind of attack it is exactly. The server maintence company we are using says it's a DDoS attack but they don't say how they found this out. Also, they are not telling us what kind of DDoS attack it is.
My site was recently under a DDoS attack and was down for a few days, the attack came from Russia i believe.
The people who did it asked for $800, but of course i didnt pay. My hosting company did the best they could in order to stop the attack but it still lasted a few days and badly hurt my rankings.
I moved my site to a dedicated server, but i dont know what kind of software/hardware i need to install on it in order to prevent more future attacks, the hosting company suggested a few things but i dont know if they are just trying to get more money out of me.
I hope liquidweb can do something about this. This is the first time Im getting DDOS. Its been almost 1hour & counting....hopefully this does not last too long. Is there anything they can do proactively to counter this attack. I have a hardware firewall with them also. I was told around 800Mbps of inbound traffic.
"This ticket is to notify you that it was necessary for us to null route 69.16.xxx.xx due to a very large inbound DDoS attack. The null route was required in order to keep our network stable and to limit the affect to our other customers. We are actively monitoring the situation, and will remove the null route as soon as the attack has subsided enough.
This is the second time I have been DDoS Attacked and it is losing my customers and my reputation. I personally think it is a rival company trying to put me out of business. So to prevent further attacks I need so protection. Is there some kind of software based protection or is it only hardware?
My website (Large Discussion Forums Site) is under a heavy DDoS attack since 3 weeks. My first host could not handle such an attack so I moved to another who claimed to have a firewall that can handle the attack, but still, the site is down.
Anyone has a good suggestion to get the site up and handle the attack? Any particular hosts that can help me?
(The Forum has its own server and does not use Apache).
Your site is now officially being DDoS Attacked. This will render your site completely offline to you, or any of your visitors/customers. Your site will continue to be attacked, and stay offline, until I receive $400.00 USD in Liberty Reserve.
Liberty Reserve Account Number: U5585060 *Payment ensures future protection from DDoS Attacks, finding future attackers, and disabling their botnets.
Valid Contact Email: drjaykrew@gmail.com
I will 100% respond to any emails sent here, so the choice is yours! If I am ignored, you know the consequences.
I laughed of course but when I checked my server... it was down for 8 hours, 18MB log file, over 700 unique IPs.
First I called the colocation... Isn't it the normal thing to do?! Who else can filter/block this attack? Unfortunately it doesn't help at all with Rapid Switch (www.rapidswitch.com - don't expect any support from them) They replied "What do you expect us to do?"
Or the exact answers:
Can you please let us know what kind of assistance you would like from us?
And the last one: Perhaps you can outline what you think it is feasible for us to do in situations like this?
No comment...
Once I saw that there is no help coming from them, I decided to move the website to a server I got at home: 3.4GHz Dell, 16GB RAM, Windows 2008 Datacenter, behind Linksys RV082 on 12Mbit adsl - perfect! My $300 router could handle the attack, but my ISP cut off port 80 after less than an hour!
So I had to move back to the server I have at the colo (Windows 2003 Enterprise, IIS6). Tried Sygate, Zonealarm and Symantec Endpoint Security - none of them helped.
Some jerk has been attacking my Windows based server for 2 days. Basically he said he has 600+ bots that connect and look like normal users. The site has been down and we have lost some serious income.
I was thinking about just using GigeServers ProxyShield as I thought it would be the easiest route but the $1000 a month is a bit much.
I donno what kind of this attack. Dddos or syn attack?. Every time my apache server down dan cpu load very high because of this.. please help me how to defend attacker like this because when im block that ip in iptables after 3/4 hour it come again with another ip. What must i do?
Many connection like below example IP 60.50.80.51. Just one ip per onetime attack but so many same ip 60.50.80.51 can see when type netstat -anp... Im just paste a few here
