We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.
View 6 RepliesI've been getting a syn flood for the last week or so.
I've pretty much tried everything I could online but have been unsuccessful in stopping them.
I talked to the data center techs and they basically can't put a stop to it either.
Here's a very small portion of my netstat
tcp 0 0 xxx.xxx.xxx.xxx:80 86.50.121.144:8540 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 41.100.16.152:7824 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 52.53.22.7:3146 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 77.217.49.124:1659 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 75.162.93.151:3230 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 113.85.63.249:1656 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 15.253.35.29:8849 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 24.56.59.180:6911 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 33.185.99.83:1917 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 103.5.8.249:4782 SYN_RECV -
root@xxx [/]# netstat -nap |grep SYN |wc -l
2008
The IP's change often and it's not possible to narrow it down.
So far the things I have done;
syn cookies enabled
reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv
increased
echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max
installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.
The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.
We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.
Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.
Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)
someone decided to attack my webserver and I can't figure out how to block it.
tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV
It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.
We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.
Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.
How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.
If I get a few servers, how would I have it setup to best defend?
one of my server were hit by massive ddos syn atack. target was port 80-apache
i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?
I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.
netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
1 127.0.0.1
1 38.99.44.101
1 64.131.90.38
1 78.176.158.75
1 78.179.73.135
1 88.229.70.143
1 88.242.97.204
1 88.247.87.58
1 92.112.211.223
3 78.176.175.136
3 88.229.40.142
3 88.231.180.181
4 78.183.227.146
18 0.0.0.0
348
348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.
Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?
View 7 Replies View RelatedDoes keepalive off help in syn flood?
View 6 Replies View RelatedMy server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.
how to Detect flood ftp.
One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.
Isn't there any solution (software-hardware) to stop that ?
one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.
View 3 Replies View Relatedflood in FTP and brute force
all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:
/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....
I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.
I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.
Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.
I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.
So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...
what to do so these connections quit jamming my server up? It's like a very very slow DOS...
When I check on port 80 connections, I get a list of few IPs with more than 100 connections.
I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?
my server under attack with syn flood and i attach the active connection during attack
View 2 Replies View Relatedsome of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !
how can we save him from these attacks?
else the firewall!
1- is there any program or script to prevent these attacks!
2- is there any rules or script's for Firewall to prevent it!
I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do
View 10 Replies View RelatedI have a Sonicwall NSA 3500. Does anyone know if you can use it to create bandwidth charts of Network Objects (e.g. IPs or Groups of IPs)?
I am thinking something like Cacti, but I don't know the code to pull that info or if it's even technically possible.
which case is more preferred: a shared web hosting service with unlimited space/bandwidth, or a dedicated one with limited space/bandwidth?
View 4 Replies View RelatedHey can anyone tell me How the whole bandwidth thing works? like lets say..if i get 100k views a month, how much bandwidth would that take?
View 7 Replies View RelatedHow will I assign the bandwidth for a VE in virtuozzo power panel. I could not find any fileds that corresponds to bandwidth in the steps during creation. I could find how to restrict memory(vmguarpages) and disk space. But where will I assign the bandwidth that a VE can use.
Also what is this bandwidth rate 8kb/s or so?
Now I keep very close tabs on my site stats. Just tonight one of my sites suddenly showed 167gb for "traffic not viewed".
That was a jump from 5gb over the course of a day.
That was done in 604877 pages and 607138 hits.
Can someone explain to me what "traffic not viewed" actually is within AWSTATS.
Next I located where most of the bw went and it appears to be http code 206 showing 159gb. My latest visitor report for the addon domain only showed one ip with an odd couple direct requests. The referring site was my own cpanel but registered to a ip in India.
How can i locate where the leak is, latest visitors isn't being much help, I have since denied the india ip which i suspect was the problem maker. How can I prevent instances such as this in the future? Being a streaming video site I have the bw to spare but it is still a bit un-nerving.
Now on top of everything Virtuozzo isn't showing anything of the sort, what do i believe?
I like the LSN server company and have a server there that I plan to keep forever, they do a great job just that I am confused about their bandwidth. Also the prices aren’t exact!
Just wondering what everyone else here thinks about this:
So... LSN are doing a Q9300 server at the moment for $130 “ish” with 2TB of bandwidth. Now let’s say someone wants an extra 0.5TB of bandwidth they pay around $50 for it and if they want 1TB they pay about $95.
So you buy a server for $130 and get 2TB of bandwidth and also the costs of the hardware, space, power is covered for the hardware. Yet they charge nearly the same price for 1TB extra to a single server, which uses no extra space, hardware or power. Another thing is they charge $25 server to pool the bandwidth between your servers.
So what I see:
2 Servers 4TB B/W @ $260 + $50 (pooling charge) = $310
1 Server 3TB B/W @ $230
1 Server 4TB B/W @ $300
So as you can see from the above you can get twice the space, RAM, CPU and Power for only $10 more? Surely it costs them more than the $10?
Also my final point is LSN have a private network, that is not bandwidth monitored and your servers can use, I asked LSN if you could tunnel the traffic from one server to another, their answer was “yes if you have the technical knowledge to do so”... Well that would get rid of the $50 pooling costs... making it actually alot cheaper to get two servers.
I'm looking to get a VPS offshore (please look at my other threads/posts to learn why) primarily for email for 4 or 5 domain names (most of which I'd download to my desktop but would also backup on the server) as well as perhaps to run a virtual desktop through and/or store some data.
For ease of use (for ME at least), I'd install (or have installed) a CP and probably run Centos 5 or Debian as the OS on the VPS. I won't be running websites from the VPS and I'll be the only user.
I've seen offers of all types related to bandwidth but, in some countries, bandwidth is expensive and they offer little as a result. How do I determine how much bandwidth I need for what I want to do and how do I know what's too little?
I have a server with a 10Mbps connection. Is there a way to limit the connection of my VPSs?
Lets say I have 10 VPS on that server, is there a way to limit them to 1Mbps each? Or do something like:
VPS_01 = 0.5Mbps
VPS_02 = 0.5Mbps
VPS_03 = 0.5Mbps
VPS_04 = 0.5Mbps
VPS_05 = 1Mbps
VPS_06 = 1Mbps
VPS_07 = 1Mbps
VPS_08 = 1Mbps
VPS_09 = 2Mbps
VPS_10 = 2Mbps
And/Or is there a way to monitor the data transfer of each VPS (how many GB/month)?
I've found a colocation company that gives me as the default 1.544Mbps as the initial bandwidth. I think this is OK for me most of the time, the problem is their bandwidth isn't really 'burstable', and If I want to expand to more bandwidth, my options are something like buying another T1's worth muxed in for $250.
Is this strange? Old-fashioned? Should I be worried about this?
i'm not familiar with colo. help this noob out.
View 14 Replies View RelatedI have a dedicated server and I would like to know how much bandwidth I use each month, this information is not provided in the control panel, is there any way to find out?
View 6 Replies View Relatedmy plesk control panel for my dedicated server and with all 3 of my domains FTP and HTTP transfers I'm getting below 500MB this month. However, GoDaddy's control panel says that I'm using 486GB. So where could the other 499.5 GB of bandwidth be coming from? I don't have that much email going on. No file attachments or anything.
View 7 Replies View Related