How To Detect Flood Ftp

May 4, 2008

My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.

how to Detect flood ftp.

View 4 Replies


ADVERTISEMENT

Syn Flood

May 11, 2009

I've been getting a syn flood for the last week or so.

I've pretty much tried everything I could online but have been unsuccessful in stopping them.

I talked to the data center techs and they basically can't put a stop to it either.

Here's a very small portion of my netstat

tcp 0 0 xxx.xxx.xxx.xxx:80 86.50.121.144:8540 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 41.100.16.152:7824 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 52.53.22.7:3146 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 77.217.49.124:1659 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 75.162.93.151:3230 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 113.85.63.249:1656 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 15.253.35.29:8849 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 24.56.59.180:6911 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 33.185.99.83:1917 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 103.5.8.249:4782 SYN_RECV -

root@xxx [/]# netstat -nap |grep SYN |wc -l
2008

The IP's change often and it's not possible to narrow it down.

So far the things I have done;

syn cookies enabled

reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv

increased
echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max

installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.

The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.

View 6 Replies View Related

SYN Flood Attack

Jul 28, 2009

We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.

Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.

Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)

View 5 Replies View Related

SYN Flood Attack

May 3, 2009

someone decided to attack my webserver and I can't figure out how to block it.

tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV

It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.

We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.

Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.

View 14 Replies View Related

How Can I Best Work With A Syn Flood?

Jun 11, 2008

How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.

If I get a few servers, how would I have it setup to best defend?

View 6 Replies View Related

Syn Flood Protection

Jul 25, 2008

one of my server were hit by massive ddos syn atack. target was port 80-apache

i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?

View 1 Replies View Related

Connection Flood

Mar 8, 2008

I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.

netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

1 127.0.0.1
1 38.99.44.101
1 64.131.90.38
1 78.176.158.75
1 78.179.73.135
1 88.229.70.143
1 88.242.97.204
1 88.247.87.58
1 92.112.211.223
3 78.176.175.136
3 88.229.40.142
3 88.231.180.181
4 78.183.227.146
18 0.0.0.0
348

348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.

View 10 Replies View Related

How To Prevent DNS Flood

May 28, 2008

Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?

View 7 Replies View Related

Does Keepalive Off Help In Syn Flood

May 29, 2008

Does keepalive off help in syn flood?

View 6 Replies View Related

UDP Flood And Bandwidth

Apr 4, 2008

We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.

View 6 Replies View Related

SYN Flood .. No Way To Stop It ?

Oct 30, 2007

One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.

Isn't there any solution (software-hardware) to stop that ?

View 14 Replies View Related

Ddos Attacks / Udp Flood

Jun 25, 2008

one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.

View 3 Replies View Related

Flood In FTP And Brute Force

Oct 27, 2008

flood in FTP and brute force

all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:

/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):

Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....

View 0 Replies View Related

Robots Flood My Server

Jul 26, 2009

I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.

I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.

Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.

I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.

So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...

what to do so these connections quit jamming my server up? It's like a very very slow DOS...

View 3 Replies View Related

Flood Connections On Port 80

Aug 1, 2007

When I check on port 80 connections, I get a list of few IPs with more than 100 connections.

I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?

View 3 Replies View Related

Inbound SYN Flood Attack

Jan 11, 2007

my server under attack with syn flood and i attach the active connection during attack

View 2 Replies View Related

How To Secure Your Web From FLOOD ; Ddos ; Etc

Jun 20, 2007

some of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !

how can we save him from these attacks?

else the firewall!

1- is there any program or script to prevent these attacks!

2- is there any rules or script's for Firewall to prevent it!

View 4 Replies View Related

Apache :: Flood Of 302s After Redirect

Jun 5, 2015

I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do

View 10 Replies View Related

How To Detect Spamming

Apr 21, 2009

How do you know your clients are sending bulk/spam emails?

I don't seem to understand the reports in "Email >> View Mail Statistics" section of WHM.

View 5 Replies View Related

Detect Memory

Jul 25, 2009

I have a private vps server works under linux ( centos ), sometimes am getting msg from csf/firewall subject:

lfd on website.com: Suspicious process running under user user account

when i check my cpanel/whm vps ( service status ) its shows that the memory limit 80% - 85% , It's had a good forum works with vb, but am wonder how to check my vps memory, i mean how to detect if there any script, or malware, or anything takes the vps memory out...

Is there any way to check,know what works under my vps, so it's take my memory limit 85%?

i check the tmp folder,

root@www [/home]# cd /tmp
root@www [/tmp]# ls -la
total 364
drwxrwxrwt 6 root root 4096 Jul 25 02:14 ./
drwxr-xr-x 21 root root 4096 Jul 18 02:21 ../
drwxrwxrwt 2 root root 4096 Jun 30 05:50 .ICE-unix/
drwxrwxrwx 18 root root 4096 Jul 2 17:33 eaccelerator/
lrwxrwxrwx 1 root root 27 Jul 18 02:13 mysql.sock -> ../var/lib/mysql/mysql.sock=
drwxr-xr-x 3 root root 4096 Jun 30 05:29 pear/
drwx------ 3 root root 4096 Jul 5 18:31 spamd-23647-init/
-rw------- 1 root root 343335 Jul 19 02:50 whatis.bk6140
root@www [/tmp]# cd /home
and the df space

root@www [~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/simfs 80G 4.1G 76G 6% /
root@www [~]#
and the services running is

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2060 156 ? Ss Jun30 1:23 init [3]
root 7465 0.0 0.0 2444 156 ? S Jul03 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/www.website.com.pid
mysql 7491 0.0 2.5 33452 10440 ? Sl Jul03 11:33 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --pid-file=/var/lib/mysql/www.website.com.pid --skip-external-locking
root 10236 0.0 6.0 27396 24764 ? Ss Jul24 0:07 /usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid --max-children=3 --max-spare=1
root 11447 0.0 1.9 18364 8020 ? S Jul24 0:00 cpsrvd - waiting for connections
root 11865 0.0 0.7 13672 3260 ? S Jul06 0:00 /usr/local/apache/bin/httpd -k start -DSSL
root 13537 0.0 3.1 15092 13064 ? Ss 00:00 0:02 lfd - sleeping
root 13703 0.0 0.3 3808 1284 ? SN Jul06 0:01 cpanellogd - sleeping for logs
root 13739 0.0 0.6 5856 2844 ? Ss Jul06 0:00 cPhulkd - processor
root 13795 0.0 1.5 14760 6304 ? S Jul06 0:00 cpdavd - accepting connections on 2077 and 2078
root 18161 0.0 0.0 1716 380 ? Ss Jun30 0:24 syslogd -m 0
root 18164 0.0 0.0 1668 72 ? Ss Jun30 0:00 klogd -x
dbus 18193 0.0 0.0 2736 212 ? Ss Jun30 0:00 dbus-daemon --system
root 18213 0.0 0.0 2716 172 ? Ss Jun30 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
root 18399 0.0 5.9 27604 24404 ? S Jul24 0:06 spamd child
root 19461 0.0 0.1 3228 684 ? Ss Jun30 0:08 crond
root 19616 0.0 0.0 1820 124 ? Ss Jun30 0:00 /usr/sbin/portsentry -

View 7 Replies View Related

How-to Detect A Possible Intruder ┐?

May 22, 2007

I have a few incomplete steps to see if I got some intruder in my Linux system.. But i really would like to have all your suggestions to make a good doc about this matter,

1.- Download and run Rkhunter & Chkrootkit
2.- Run "w", and "netstat -nalp |grep "SHPORTHERE" to see whos connected using SSH
3.- Search for ssh and ftp accepted logins.

Code:
last
cat /var/log/secure* | grep ssh | grep Accept
cat /var/log/secure* |grep ftp |grep Accept
less /var/log/messages | grep ftp
4.- Watch current connections and scan your ports.

Code:
netstat -nalp
nmap 1-65535 localhost
5.- Search for suspicious content on common explotable dirs.

Code:
rm -rf /tmp/sess*
rm -rf /var/dos-*
rm -rf /var/tmp/ssh-*
rm -rf /var/tmp/dos-*
ls /tmp -lab
ls /var/tmp -labR
ls /dev/shm -labR
ls /usr/local/apache/proxy -labR
ls /usr/local/samba -labR
6.- Checking for anomalies on this files.

Code:
less /etc/passwd
less /etc/shadow
less /etc/groups
7.- Search for new users at sudoers, check wtmp and telnet is not running.

Code:
cat /etc/sudoers
who /var/log/wtmp
cat /etc/xinetd.d/telnet
8.- Find bash history files

Code:
find '/' -iname .bash_history
9 .- Verify the Crontab table

Code:
crontab -l
10 .- Update the slocate database and search for exploits.

Code:
updatedb &
For cPanel servers:

Code:
egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20' /usr/local/apache/logs/*
egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20' /home/*/statistics/logs/*
For Ensim servers:

Code:
egrep -i '(chr(|system()|(curl|wget|chmod|gcc|perl)%20'/home/virtual/site*/fst/var/log/httpd/*
Search for shell code:

Code:
cat /path/of/your/web/logs/* |grep "/x90/"
11.- Search for hidden dirs

Code:
locate "..."
locate ".. "
rlocate " .."
locate ". "
locate " ."
12.- Search for perl-scripts running

Code:
ps -aux | grep perl
13 .- Checking nobody user and open files.

Code:
service httpd stop
lsof -u nobody

View 14 Replies View Related

Detect Errors On Server

Apr 6, 2009

I have a server of my own. Unfortunatlly 20% of the time, the server is down even though my connection to internet always up.

I am checking the event log but cannot see anything odd...
OS:Windows server 2003

Is there any tool to detect why the server is down most of the time?

I can post the event viewer errors that I can find suspeicious if needed.

View 2 Replies View Related

How To Detect A DDoS Attack ...

May 19, 2009

is there any proved method to determine what kind of attack you are under? Our server has been under attack for more than a day now but so far we have not been able to find out what kind of attack it is exactly. The server maintence company we are using says it's a DDoS attack but they don't say how they found this out. Also, they are not telling us what kind of DDoS attack it is.

View 14 Replies View Related

Is It Possible To Detect User's Pc Configuation

Jul 31, 2009

i have some issue,

sometimes,a user may be banned by our firewall,

or the dns of his pc does not work well,...and so on,

by the way,

they can not link to server,

and it spend a lot of time to check where is wrong from his pc aside.

i want to ask if it is possible i use a php script or a exe let him to execute,

and it will help me detect user's pc configuation,

it include his IP/DNS/fateway/trace and ping result,...and so on.

View 4 Replies View Related

How To Detect A VPS And Its Technology In Linux

Jul 25, 2008

Is there any way to distinguish a dedicated server from VPS using Linux commands and detect the implemented virtualization technology like XEN and OpenVZ, ...?

I have received a dedicated server and in cPanel its written Virtuozzo but they tell me it's XEN , beside this what's the reason to implement a virtualization technic while they give me a dedicated server? Maybe to obtain cheaper cPanel license,

View 8 Replies View Related

Host Ability To Self Detect

Nov 13, 2008

Do web hosts have the means to self-detect or self-correct problems with people's websites? If so, is there a name for this ability?

Seems that every host I've used has to be *told* about major problems, such as the server or database being down completely. I'm tired of going out of town fearing a site crash. I don't expect them to catch every problem, but when the failure is so blatant, it would be nice if they caught it...

How would I find a host who does this?

View 11 Replies View Related

How To Detect Is It Domain Name Server (DNS) Or Http Down?

Aug 1, 2009

If i put domain.com on uptime checker,and downtime is detected,downtime will be reported if dns is down or if http server is down.So question is what i need to do to see what exactly went down?For network uptime i can ping ip adress,but for these two i really don't know.

View 3 Replies View Related

C99Shell :: Detect And Disable C99 Shell?

Aug 15, 2008

how i can detect and disable C99 shell and another shell script exp:r57 ....

View 9 Replies View Related

Detect The Costa Rica ISP's Website

Sep 28, 2009

I know the ISP is RADIGRAFICA COSTARRICENSE, and the server location is San JosÚ in Costa Rica.

I googled the ISP name RADIGRAFICA COSTARRICENSE, trying to find out the company site which offer's web hosting service, but I can only find racsa.co.cr; however, this doesn't look like a web hosting company.

View 2 Replies View Related

How To Detect What Exactly Caused High Load

Aug 2, 2009

On one server which i have sometime appear very high load up to 70,and that causing downtime of few minutes(i have historic data webmin module where i saw high load and downtime time matches,but it doesn't show what causing it).That server also have hardware raid in mirror mode.(copies exact data from one disk to another).

View 14 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved