How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.
If I get a few servers, how would I have it setup to best defend?
I've been getting a syn flood for the last week or so.
I've pretty much tried everything I could online but have been unsuccessful in stopping them.
I talked to the data center techs and they basically can't put a stop to it either.
Here's a very small portion of my netstat
tcp 0 0 xxx.xxx.xxx.xxx:80 86.50.121.144:8540 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 41.100.16.152:7824 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 52.53.22.7:3146 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 77.217.49.124:1659 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 75.162.93.151:3230 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 113.85.63.249:1656 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 15.253.35.29:8849 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 24.56.59.180:6911 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 33.185.99.83:1917 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 103.5.8.249:4782 SYN_RECV -
root@xxx [/]# netstat -nap |grep SYN |wc -l
2008
The IP's change often and it's not possible to narrow it down.
So far the things I have done;
syn cookies enabled
reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv
increased
echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max
installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.
The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.
We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.
Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.
Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)
someone decided to attack my webserver and I can't figure out how to block it.
tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV
It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.
We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.
Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.
one of my server were hit by massive ddos syn atack. target was port 80-apache
i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?
I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.
netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
1 127.0.0.1
1 38.99.44.101
1 64.131.90.38
1 78.176.158.75
1 78.179.73.135
1 88.229.70.143
1 88.242.97.204
1 88.247.87.58
1 92.112.211.223
3 78.176.175.136
3 88.229.40.142
3 88.231.180.181
4 78.183.227.146
18 0.0.0.0
348
348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.
Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?
View 7 Replies View RelatedDoes keepalive off help in syn flood?
View 6 Replies View RelatedMy server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.
how to Detect flood ftp.
We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.
View 6 Replies View RelatedOne of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.
Isn't there any solution (software-hardware) to stop that ?
one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.
View 3 Replies View Relatedflood in FTP and brute force
all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:
/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....
I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.
I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.
Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.
I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.
So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...
what to do so these connections quit jamming my server up? It's like a very very slow DOS...
When I check on port 80 connections, I get a list of few IPs with more than 100 connections.
I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?
my server under attack with syn flood and i attach the active connection during attack
View 2 Replies View Relatedsome of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !
how can we save him from these attacks?
else the firewall!
1- is there any program or script to prevent these attacks!
2- is there any rules or script's for Firewall to prevent it!
I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do
View 10 Replies View Relatedim using centOS 5 with webmin in my vps.
im installing webmin and do this: [Apache Webserver] / select [Default Server]
and my website work fine ,
but when i check my web site for example
[url]not working!
[url]Work fine!
how i can solve problem
work with www and without www.
I'm having exec cgi issues,
CentOS 5.3 x86_64, Linux, Apache/2.0.63,
cPanel 11.24.4-R36167 - WHM 11.24.2 - X 3.9
Error is,
[an error occurred while processing this directive]
If I "uncheck" IncludesNOEXEC in Apache Global Configuration the error disappears, but the SSI doesn't work. If I check it the error is there, but the SSI works.
Here's what I have done so far,
Through WHM,
Main >> Service Configuration >> Apache Configuration,
Pre Main Include, Pre VirtualHost Include, Post VirtualHost Include,
I added,
Options +Includes
AddType text/html .htm
AddType text/html .html
AddOutputFilter INCLUDES .htm
AddOutputFilter INCLUDES .html
Options +ExecCGI
AddHandler cgi-script .cgi .pl
I also added this to the httpd.conf
<Directory "/">
Options +ExecCGI FollowSymLinks Includes IncludesNOEXEC Indexes -MultiViews SymLinksIfOwnerMatch
AllowOverride All
</Directory>
Options +ExecCGI
AddHandler cgi-script .cgi .pl
Then I tried,
Options +ExecCGI
AddHandler cgi-script .cgi .pl
in the .htaccess file
I got a vps and I dont really understand how ram works but my sites arent really that big yet actually not at all at least teh ones on the vps. I am using directadmin as the panel.
I am using 279mb.
I installed GD via yum. Yet I cant get it to work I get all kinds of error's like libpng is missing then I got libXpm is missing, then freetype is missing yet all the libs exsist,
View 4 Replies View RelatedAfter spending nearly 4 days trying to get ftp working on my server i still haven't achieved it. I got a server with a default install of plesk and cent os 4. I update to 8.2 and when i first go to try ftp it says "server closed connection" on my ftp client.
So then i tried updating 8.2 again and the installer failed. So i tried manually installing both proftpd and pureftpd via ssh and yum and it fails to install. I've also restarted the server a few times. I've tried logging in with every single username/domain/i.p. assigned to the server. and i've had no luck.
I installed Lighttpd + PHP 5.2.1 with FastCGI
Any php page that starts with <?php is working fine..
but when the page starts with only <?, it does not work
how does SSH work and really what is it.
This is my knowledge, I may be wrong or right:
There are two ways of controlling your server, through control panel and through SSH, now SSH is where you type in codes to control your server.
Now from what I know you can't login to SSH alot due to security reasons.
I was wondering, if I have a forum can I login to SSH everyday to back up the database?
Whenever I tried to upload large files to my server it restarts the upload again and again and never actually uploads. It just keeps overwriting the previous file. I don't get any errors? It just automatically reuploads and overwrites the files everytime.
View 2 Replies View RelatedMy site is under DDOS attack. I run this command
netstat -an | grep :80 | grep ffff | awk '{print $5}' | cut -f 4 -d : | sort | uniq -c | sort -n | tail -10
And find a lot of IP that are attacking. After that, i run
iptables -A INPUT -s xxx -j DROP
to block IP, and
service iptables save
service iptables restart
But when i run netstat command abouve, i found IP are attacking still available, it seem iptables don't block it?
I would like to know how servers work, like how to build, set up, and how they work, what software is in them? Also could I own a server and send them to a data center and host them there?
Also a little infomation on Data Center. Could you share me some knowlage.
some clarification with regards to Reverse DNS.
An example ip: xx.xxx.xxx.xx is owned by A Company via a DC. The they have their name allocated to the netname and description when i look up their ip address.
I have my ip xx.xxx.xxx.xx this is me and it currently contains my DC's name throughout when i look it up as the description and netname...
Both are from the same DC however the other company has their name allocated to the ip address and i would like to do the same. Does this require Reverse DNS? It dosent involve domains surely does it?
I try to install wordpress on my dedicated server but in the begin i get this error:
Your PHP installation appears to be missing the MySQL extension which is required by WordPress
I have centos 5.3 and i have run the command: service mysql start
But i think mysql server is not running, because i have kloxo and from the panel i can see what servers are running.
