Inbound SYN Flood Attack

Jan 11, 2007

my server under attack with syn flood and i attach the active connection during attack

View 2 Replies


ADVERTISEMENT

SYN Flood Attack

Jul 28, 2009

We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.

Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.

Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)

View 5 Replies View Related

SYN Flood Attack

May 3, 2009

someone decided to attack my webserver and I can't figure out how to block it.

tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV

It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.

We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.

Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.

View 14 Replies View Related

VPS With Mostly Inbound Traffic

Mar 24, 2009

Imagine you want a set of servers (VPSs would be a cheaper choice, that is why I am posting here) that do not have much outbound traffic but download from other servers (more or less as spiders, but I am not trying to create a web index). Disk space or memory size are not important, but port speed and monthly transfer should be as high as possible. As inbound traffic is less frequently used, I wonder if any provider offer cheaper rates if traffic is like this.

I have been searching the forums and have not found too much about this topic (a quite related post named "I want to download the Internet" or something similar did not get a conclusion).

View 10 Replies View Related

Why Inbound Traffic So High

Dec 18, 2008

Why did my inbound traffic jump? Any ideas what could be happening here? I have this server and do not upload anything on the server?

View 12 Replies View Related

Is It Possible To Specify An IP Address To Use For Inbound Traffic

Feb 23, 2007

I have 2 IPs bounded on a Windows 2003 server. These 2 IPs have different network routes (one uses network A, one uses network B). Obviously for outbound traffic I can freely choose which IP to use (I simply choose to use [url]or [url]), however I wonder if it's possible to tell the server which IP it should use for inbound traffic when I need to download something from the internet to the server?

View 1 Replies View Related

Iptables - Block Inbound & Outbound

Jun 20, 2007

What is the command I need to issue to block an IP address from my server? I need to block both inbound and outbound access.

I need the rule to append to existing rules so if the server is rebooted the rule will still be in effect.

View 9 Replies View Related

Syn Flood

May 11, 2009

I've been getting a syn flood for the last week or so.

I've pretty much tried everything I could online but have been unsuccessful in stopping them.

I talked to the data center techs and they basically can't put a stop to it either.

Here's a very small portion of my netstat

tcp 0 0 xxx.xxx.xxx.xxx:80 86.50.121.144:8540 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 41.100.16.152:7824 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 52.53.22.7:3146 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 77.217.49.124:1659 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 75.162.93.151:3230 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 113.85.63.249:1656 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 15.253.35.29:8849 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 24.56.59.180:6911 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 33.185.99.83:1917 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 103.5.8.249:4782 SYN_RECV -

root@xxx [/]# netstat -nap |grep SYN |wc -l
2008

The IP's change often and it's not possible to narrow it down.

So far the things I have done;

syn cookies enabled

reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv

increased
echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max

installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.

The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.

View 6 Replies View Related

Error APF :: {glob} Opening Inbound Udp Port

Aug 10, 2008

We have following error when try to start apf in one of our vps:

apf(3126): {glob} opening inbound tcp port 80 on 0/0
apf(3126): {glob} opening inbound tcp port 110 on 0/0
apf(3126): {glob} opening inbound tcp port 111 on 0/0
apf(3126): {glob} opening inbound tcp port 143 on 0/0
apf(3126): {glob} opening inbound tcp port 443 on 0/0
apf(3126): {glob} opening inbound tcp port 465 on 0/0
apf(3126): {glob} opening inbound tcp port 623 on 0/0
apf(3126): {glob} opening inbound tcp port 918 on 0/0
apf(3126): {glob} opening inbound tcp port 993 on 0/0
apf(3126): {glob} opening inbound tcp port 995 on 0/0
apf(3126): {glob} opening inbound tcp port 2082 on 0/0
apf(3126): {glob} opening inbound tcp port 2083 on 0/0
apf(3126): {glob} opening inbound tcp port 2086 on 0/0
apf(3126): {glob} opening inbound tcp port 2087 on 0/0
apf(3126): {glob} opening inbound tcp port 2095 on 0/0
apf(3126): {glob} opening inbound tcp port 2096 on 0/0
apf(3126): {glob} opening inbound tcp port 3306 on 0/0
apf(3126): {glob} opening inbound tcp port 3389 on 0/0
apf(3126): {glob} opening inbound tcp port 6666 on 0/0
apf(3126): {glob} opening inbound tcp port 7776 on 0/0
apf(3126): {glob} opening inbound tcp port 7777 on 0/0
apf(3126): {glob} opening inbound tcp port 7778 on 0/0
apf(3126): {glob} opening inbound tcp port 7779 on 0/0
apf(3126): {glob} opening inbound tcp port 8887 on 0/0
apf(3126): {glob} opening inbound tcp port 8888 on 0/0
apf(3126): {glob} opening inbound tcp port 8889 on 0/0
apf(3126): {glob} opening inbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 161 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 22 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 26 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 27 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 37 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 43 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 110 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 113 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 2089 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 3389 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 20 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 161 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 3 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 5 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 11 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 0 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 30 on 0/0

View 3 Replies View Related

Port Speed: Big Difference Inbound Vs Outbound

May 18, 2008

I am moving into the world of dedicated servers (from VPS). I just got a server from Serveraday.com /OLM.net.

When I was doing bandwidth tests, I found the server's inbound speed was much slower than outbound. I tried downloading a bunch of different provider's 10MB test files from the command line of my server using wget. They were all around 20-30 Kbps.

When I take those same 10MB files and serve them from my dedicated box, the results are much different. My server can push the files out at over 1Mbps.

Why would my server be set up this way, and is this normal behaviour? I sent a ticket to OLM, but their support seems to take a long time. So I figured I would bounce the question off of all you here on WHT

View 9 Replies View Related

Monitor/audit Inbound/outbound Emails

Apr 18, 2008

any good solution for corporates out there?

View 13 Replies View Related

Mailenable : Copy All Inbound / Outbound Email

Feb 16, 2007

I'm using the free edition of MailEnable and need to configure each post office to copy all incoming and outgoing email to one of the email accounts on the same post office.

Is there a way to configure this ?

I know I can configure mail forwarding on incoming mail per account but need to do it for all acounts (except the audit account).

e.g. anythinghere@dbnetsolutions.co.uk
incoming or outgoing would be copied to audit@dbnetsolutions.co.uk

View 0 Replies View Related

Plesk 12.x / Linux :: Inbound TLS Due To Standard DNS Template

Jul 17, 2014

With the standard-DNS-Layout every customer has an MX-entry like MX 10 mail.customerdomainexample.com

The problem is, that inbound mailservers get a TLS warning, because the mailhostname does not match mail.companydomainexample.com, which is the domain with a valid SSL-Certificate pointing to the same server.

Wouldn't it make sense to change the default template to mail.companydomainexample.com since it is the same machine anyway?

View 2 Replies View Related

How Can I Best Work With A Syn Flood?

Jun 11, 2008

How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.

If I get a few servers, how would I have it setup to best defend?

View 6 Replies View Related

Syn Flood Protection

Jul 25, 2008

one of my server were hit by massive ddos syn atack. target was port 80-apache

i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?

View 1 Replies View Related

Connection Flood

Mar 8, 2008

I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.

netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

1 127.0.0.1
1 38.99.44.101
1 64.131.90.38
1 78.176.158.75
1 78.179.73.135
1 88.229.70.143
1 88.242.97.204
1 88.247.87.58
1 92.112.211.223
3 78.176.175.136
3 88.229.40.142
3 88.231.180.181
4 78.183.227.146
18 0.0.0.0
348

348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.

View 10 Replies View Related

How To Prevent DNS Flood

May 28, 2008

Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?

View 7 Replies View Related

Does Keepalive Off Help In Syn Flood

May 29, 2008

Does keepalive off help in syn flood?

View 6 Replies View Related

How To Detect Flood Ftp

May 4, 2008

My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.

how to Detect flood ftp.

View 4 Replies View Related

UDP Flood And Bandwidth

Apr 4, 2008

We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.

View 6 Replies View Related

SYN Flood .. No Way To Stop It ?

Oct 30, 2007

One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.

Isn't there any solution (software-hardware) to stop that ?

View 14 Replies View Related

Plesk 12.x / Windows :: Spammers Blocking Inbound SMTP

Sep 19, 2014

I am having some problems with the inbound smtp sockets, we are receiving a constant attack from spammers, and they are taking all the sockets we have open for our users. We have enable SPF, greylisting, inbound control access through authentication, relay access with authentication also. but after some weeks we are on the same situation yet. We have spam assasin also installed as power pack from plesk, and we have add DSN black list from b.barracudacentral.org, bl.mailspike.net and bl.spamcop.net but we still suffer from this problem.

We have also try to increase the socket assigned to 200 and after some minutes they used all again and the CPU change increase up to 25% of the total capacity.

View 3 Replies View Related

Ddos Attacks / Udp Flood

Jun 25, 2008

one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.

View 3 Replies View Related

Flood In FTP And Brute Force

Oct 27, 2008

flood in FTP and brute force

all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:

/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):

Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....

View 0 Replies View Related

Robots Flood My Server

Jul 26, 2009

I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.

I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.

Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.

I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.

So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...

what to do so these connections quit jamming my server up? It's like a very very slow DOS...

View 3 Replies View Related

Flood Connections On Port 80

Aug 1, 2007

When I check on port 80 connections, I get a list of few IPs with more than 100 connections.

I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?

View 3 Replies View Related

How To Secure Your Web From FLOOD ; Ddos ; Etc

Jun 20, 2007

some of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !

how can we save him from these attacks?

else the firewall!

1- is there any program or script to prevent these attacks!

2- is there any rules or script's for Firewall to prevent it!

View 4 Replies View Related

Plesk 11.x / Linux :: All Inbound Emails Bouncing - TLS Negotiation Failed

Nov 23, 2014

I ran the script in KB article 123160 [1] to disable SSLv3 and avoid the POODLE vulnerability, but I recently discovered that this has caused all inbound emails to bounce. The bounce message says, "TLS Negotiation failed."

Here is Plesk version information:

# cat /usr/local/psa/version
11.5.30 CentOS 5 115140407.17

# cat /root/.autoinstaller/microupdates.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<patches>
<product id="plesk" version="11.5.30" installed-at="20131109T085857">
<patch version="47" timestamp="" installed-at="20141123T162005" />

[URL] ....

View 3 Replies View Related

Apache :: Flood Of 302s After Redirect

Jun 5, 2015

I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do

View 10 Replies View Related

Plesk 12.x / Linux :: Keep Permanent Record Of All Mail Inbound And Outbound - Log Rotation Settings

Nov 19, 2014

1/ What is the difference between maillog and maillog.processed? I want to keep a permanent record of all mail inbound and outbound even if delivery is deferred by the gray listing. I'm not sure which one is the best to keep.

2/ I would like to change the way that the mail logs get log rotated. I am struggling to work out exactly what happens at the moment but I would like to rotate the log out every day regardless of size. I think currently that the maillog.processed is rotated daily if it is over a specific size.

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved