Connection Flood
Mar 8, 2008
I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.
netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
1 127.0.0.1
1 38.99.44.101
1 64.131.90.38
1 78.176.158.75
1 78.179.73.135
1 88.229.70.143
1 88.242.97.204
1 88.247.87.58
1 92.112.211.223
3 78.176.175.136
3 88.229.40.142
3 88.231.180.181
4 78.183.227.146
18 0.0.0.0
348
348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.
View 10 Replies
ADVERTISEMENT
May 11, 2009
I've been getting a syn flood for the last week or so.
I've pretty much tried everything I could online but have been unsuccessful in stopping them.
I talked to the data center techs and they basically can't put a stop to it either.
Here's a very small portion of my netstat
tcp 0 0 xxx.xxx.xxx.xxx:80 86.50.121.144:8540 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 41.100.16.152:7824 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 52.53.22.7:3146 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 77.217.49.124:1659 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 75.162.93.151:3230 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 113.85.63.249:1656 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 15.253.35.29:8849 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 24.56.59.180:6911 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 33.185.99.83:1917 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 103.5.8.249:4782 SYN_RECV -
root@xxx [/]# netstat -nap |grep SYN |wc -l
2008
The IP's change often and it's not possible to narrow it down.
So far the things I have done;
syn cookies enabled
reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv
increased
echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max
installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.
The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.
View 6 Replies
View Related
Jul 28, 2009
We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.
Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.
Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)
View 5 Replies
View Related
May 3, 2009
someone decided to attack my webserver and I can't figure out how to block it.
tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV
It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.
We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.
Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.
View 14 Replies
View Related
Jun 11, 2008
How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.
If I get a few servers, how would I have it setup to best defend?
View 6 Replies
View Related
Jul 25, 2008
one of my server were hit by massive ddos syn atack. target was port 80-apache
i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?
View 1 Replies
View Related
May 28, 2008
Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?
View 7 Replies
View Related
May 29, 2008
Does keepalive off help in syn flood?
View 6 Replies
View Related
May 4, 2008
My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.
how to Detect flood ftp.
View 4 Replies
View Related
Apr 4, 2008
We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.
View 6 Replies
View Related
Oct 30, 2007
One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.
Isn't there any solution (software-hardware) to stop that ?
View 14 Replies
View Related
Jun 25, 2008
one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.
View 3 Replies
View Related
Oct 27, 2008
flood in FTP and brute force
all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:
/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....
View 0 Replies
View Related
Jul 26, 2009
I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.
I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.
Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.
I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.
So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...
what to do so these connections quit jamming my server up? It's like a very very slow DOS...
View 3 Replies
View Related
Aug 1, 2007
When I check on port 80 connections, I get a list of few IPs with more than 100 connections.
I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?
View 3 Replies
View Related
Jan 11, 2007
my server under attack with syn flood and i attach the active connection during attack
View 2 Replies
View Related
Jun 20, 2007
some of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !
how can we save him from these attacks?
else the firewall!
1- is there any program or script to prevent these attacks!
2- is there any rules or script's for Firewall to prevent it!
View 4 Replies
View Related
Apr 7, 2008
I have ftp server (pure-ftp). with firewall.
i allowed 20 and 21 port in "CSF" firewall
now when i or our client connect to the server connection done.
and the they fire dir or ls command they will receive error
"425 Could not open data connection to port 2535: Connection timed out"
what is the problem.i have already allowed passive port 2500:3500 then why i received this types of error
View 3 Replies
View Related
Jun 5, 2015
I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do
View 10 Replies
View Related
May 14, 2008
i do a tracert on my VPS and get the attached results. My location is South Africa. Lately it just seems a bit sluggish. Can somebody please do a tracert from USA and EU for me please to do a comparisons or advice me on this VPS
View 13 Replies
View Related
Jan 6, 2007
I am on a VPS server and want to know in high traffic conditions how many connections per IP address can come... because on my site connections per IP going to 300 and mostly around 100.
But these are fluctuating and from different locations... everytime.. so dont think as a Dos but so many connections per IP makes my server down for few minutes until connections dont go down.
how many maximum connections per IP will be fine... for a little popular site.
View 5 Replies
View Related
Dec 11, 2007
I have a directory, named downloads/
I have some huge files for download in this directory.
now, when our users trying to download files from this folder with flashget (or dap or ...) this programs create 5 connection to that files! so If a user trying to download 5 files , he have 25 connection to my server!
How can I limit connection per Ip on file in this folder ?
View 5 Replies
View Related
Dec 18, 2007
Today i get alert from server provider saying my server is under attack, i check netstat and found too many connections.
Quote:
This ticket was automatically generated by the Softlayer Network Protection System. Due to the large amount of traffic targeted to your IP address 74.86.157.184, SoftLayer has automatically injected the IP address into our Cisco Guard Protection system. This system diverts traffic destined to the IP address 74.86.157.184 through hardware devices that will try to identify and block the specific packets and flows responsible for the attack while allowing legitimate transactions to pass. The injection of 74.86.157.184 will remain in place until this attack subsides and then be automatically removed once traffic levels reach a normal level.
Details of the event follow:
Exceeded Bits In: 782.7 M (Threshold: 500 M)
[url]
The connections are from my server to port 80 of "140.211.166.134".
lsof -i :port gives
PHP Code:
# lsof -i :47837
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
crond 16004 root 269u IPv4 48880489 TCP server20.hosthat.com:47837->ftp-osl.osuosl.org:http (CLOSE_WAIT)
udevd 31116 root 269u IPv4 48880489 TCP server20.hosthat.com:47837->ftp-osl.osuosl.org:http (CLOSE_WAIT)
yum-updat 31347 root 269u IPv4 48880489 TCP server20.hosthat.com:47837->ftp-osl.osuosl.org:http (CLOSE_WAIT)
auditd 31683 root 269u IPv4 48880489 TCP server20.hosthat.com:47837->ftp-osl.osuosl.org:http (CLOSE_WAIT)
python 31685 root 269u IPv4 48880489 TCP server20.hosthat.com:47837->ftp-osl.osuosl.org:http (CLOSE_WAIT)
ntpd 31715 ntp 269u IPv4 48880489 TCP server20.hosthat.com:47837->ftp-osl.osuosl.org:http (CLOSE_WAIT)
#
I have rebooted the server and now server is normal.
I disabled yum on the server. Some days back, i have same problem with another server, server have too many connection to one of the yum respositry IP. The OS is CentOS 5.1
View 2 Replies
View Related
Jun 7, 2007
This is an error that dns report spat out to me. I have the firewall disabled as of now so I don't understand why packets would be blocked..if they are being blocked. From what I can tell, I can get to the server and resolve no problem...but could that stop other dns servers from connecting to it? I recently moved my cpanel box to another location in the LT datacenter in order to get on a different subnet - the previous one was a spam list nightmare. All IP's have been changed over and such...is this just cached from like the 14 hours I was down (ouch!) or is this still happening? I mean...its able to look up a records and it can get the mx servers...
error: Our local DNS server was unable to get your MX record. This usually means that a firewall in front of your DNS server is interfering. For example, it may be blocking DNS packets from low source port numbers (ours is often in the 1024-1030 range). Firewalls should never block DNS queries based on the source IP address; otherwise, it is guaranteed that legitimate queries will be blocked. This specific lookup must be cached, so a recent change may not be reflected.
View 5 Replies
View Related
May 28, 2007
I have a Linux box running CPanel and am having issues with 1 particular client trying to connect using FTP. I am also running lfd and csf.
The problem is that whenever they try to ftp to the server (regardless of the domain), they get an error saying:
"Connection to host lost".
I look through the logs (/var/log/messages) and see that there was a connection made and closed. No errors.
Otherwise, all my clients can connect without a problem.
View 6 Replies
View Related
May 20, 2008
I dont know much about server. I was wondering: if I plug in my laptop at work would the server log my connection, even if my laptop is not a client?
View 2 Replies
View Related
Jun 28, 2009
where I can't access my terminal because my connections keep getting timed out. Its been ok previously but for the last 2 days I could not connect because the connection timed out 9/10 times. No modifications were made during this time so whats the problem guys?
View 4 Replies
View Related
Jul 29, 2009
I am checking WHM apache status and I am seeing roughly 72+ connection from 127.0.0.1 (server), why? What could be the problem? Is the server hanging up or is this an indication that something is broken in the server?
View 2 Replies
View Related
Oct 28, 2009
Is anyone having issues with connection dropping alot with FDC servers?
View 2 Replies
View Related
Apr 3, 2009
I just saw a post talking about a better connection to Brazil, but according to the "internet lines", Peru has a different connection.
So, almost 80% of the people here uses Telefonica and some Telmex. I know ThePlanet has direct connect with Telefonica, but, is there any other good provider with the same benefits or even better?
View 4 Replies
View Related
