Syn Flood Protection

Jul 25, 2008

one of my server were hit by massive ddos syn atack. target was port 80-apache

i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?

View 1 Replies


Syn Flood

May 11, 2009

I've been getting a syn flood for the last week or so.

I've pretty much tried everything I could online but have been unsuccessful in stopping them.

I talked to the data center techs and they basically can't put a stop to it either.

Here's a very small portion of my netstat

tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -

root@xxx [/]# netstat -nap |grep SYN |wc -l

The IP's change often and it's not possible to narrow it down.

So far the things I have done;

syn cookies enabled

reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv

echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max

installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.

The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.

View 6 Replies View Related

SYN Flood Attack

Jul 28, 2009

We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.

Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.

Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)

View 5 Replies View Related

SYN Flood Attack

May 3, 2009

someone decided to attack my webserver and I can't figure out how to block it.

tcp 0 0 localhost:80 SYN_RECV
tcp 0 0 localhost:80 SYN_RECV
tcp 0 0 localhost:80 SYN_RECV

It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.

We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.

Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.

View 14 Replies View Related

How Can I Best Work With A Syn Flood?

Jun 11, 2008

How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.

If I get a few servers, how would I have it setup to best defend?

View 6 Replies View Related

Connection Flood

Mar 8, 2008

I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.

netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n


348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.

View 10 Replies View Related

How To Prevent DNS Flood

May 28, 2008

Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?

View 7 Replies View Related

Does Keepalive Off Help In Syn Flood

May 29, 2008

Does keepalive off help in syn flood?

View 6 Replies View Related

How To Detect Flood Ftp

May 4, 2008

My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.

how to Detect flood ftp.

View 4 Replies View Related

UDP Flood And Bandwidth

Apr 4, 2008

We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.

View 6 Replies View Related

SYN Flood .. No Way To Stop It ?

Oct 30, 2007

One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.

Isn't there any solution (software-hardware) to stop that ?

View 14 Replies View Related

Ddos Attacks / Udp Flood

Jun 25, 2008

one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.

View 3 Replies View Related

Flood In FTP And Brute Force

Oct 27, 2008

flood in FTP and brute force

all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:

/etc/apf/apf -d {bfd.pure-ftpd}
The following are event logs from on service pure-ftpd (all time stamps are GMT -0500):

Oct 25 13:52:37 svr1 pure-ftpd: (?@ [INFO] New connection from
Oct 25 13:52:37 svr1 pure-ftpd: (?@ [INFO] New connection from
Oct 25 13:52:38 svr1 pure-ftpd: (?@ [WARNING] Authentication failed for user [router] ....

View 0 Replies View Related

Robots Flood My Server

Jul 26, 2009

I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.

I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.

Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.

I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.

So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...

what to do so these connections quit jamming my server up? It's like a very very slow DOS...

View 3 Replies View Related

Flood Connections On Port 80

Aug 1, 2007

When I check on port 80 connections, I get a list of few IPs with more than 100 connections.

I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?

View 3 Replies View Related

Inbound SYN Flood Attack

Jan 11, 2007

my server under attack with syn flood and i attach the active connection during attack

View 2 Replies View Related

How To Secure Your Web From FLOOD ; Ddos ; Etc

Jun 20, 2007

some of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !

how can we save him from these attacks?

else the firewall!

1- is there any program or script to prevent these attacks!

2- is there any rules or script's for Firewall to prevent it!

View 4 Replies View Related

DDoS Protection Providers Vs DDoS Protection Scripts

Oct 8, 2009

I am looking for some good ddos protection providers, via protected dns. I've searched on internet, but most of them are really expensive.

Please tell me some ddos protection providers what could help me.(gige is too expensive btw).

And I found some ddos protection scripts. How can a script protected a server from ddos? A sript like CSF or DDoS deflate?

View 12 Replies View Related

Apache :: Flood Of 302s After Redirect

Jun 5, 2015

I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do

View 10 Replies View Related

Ddos Protection/ Different Ip's

Apr 16, 2009

Hey guys If there was a way to have the ips of the dedi change constantly would this help prevent ddos attacks or would there be no difference if the domain was being attacked.

View 2 Replies View Related

DDos Protection.

May 25, 2009

i'am looking for a software based ddos protection,some one know something for try to mitigate a ddos or help to get the server rock a solid?And i need to know too where i change the DNS(vhost) of my DEDICATED server.

View 4 Replies View Related

DDoS Protection ...?

Sep 24, 2009

so a guy I know runs a site, it's being hit very hard with a DDoS attack. He's spending about 500 /month to keep his site online. He's using ServerTech, but for the last few days, it's been offline and they have been non-responsive for the most part. I'm guessing they just don't know what to do.

Do you guys have any recommendations for any DDoS protected hosting? He doesn't really want to pay more, if he doesn't have to.

View 14 Replies View Related

Layer 2-4 DoS Protection

Apr 5, 2009

What exactly does the DoS protection layer 2-4?

in which attacks are successful.?

View 1 Replies View Related

Irc Vps With Ddos Protection

May 6, 2008

if any of you could recomened a ddos prottected vps that allows ircd to be run im curentley in process of waiting for setup from sharktek but there slow response /setup time is making me wonder if its worth it please post your recommendations here then i can start my own reasearch from your list

View 11 Replies View Related

Network Protection

Jun 20, 2008

As we prepare to ramp up new networks, we are looking at different network attack protection devices such as Intruguard.

I am interested in input on other devices out there, or ideas using devices to protect against flood attacks and DDOS on a network that is under a gig in speed (100-200 Mbps).

View 4 Replies View Related

DDoS Protection Or Not

Apr 24, 2008

Is bound to happen to my server one day or another (get attacked). So I need help deciding whether to get a DDoS protection server now or later. Or pay as I go (I'll explain this in a bit).

First of all I am considering getting this because I want to use this server to hide the real source where people are downloading from. People connect only through FTP server and download. Of course if I give the real IP away I am subject to attack at anytime from anyone.

I think if I buy a server somewhere else and have people connect to there then that server will connect to the real server if I was to get attacked the server I bought "somewhere" else would only get attacked which would or would not be protected by a that special company who protects for these kind of things.

Only downside so far is I have been able to have the method above done. A person connects from one server which connects to the real server they will be downloading from BUT I use up to 2x bandwidth. Because when someone requests a file from server A...server B sends to server A then sends back to the user requesting it. A process that well works but anyone know if instead of sending back to Server A it will go directly to the user without exposing any info on the real server?

When I meant "pay as you go" I mean have a server with a DDoS protection company but don't get any protection until it happens rather than waiting on the last minute before switching to them (like adding new users now but those users knowing the real source).

These "users" downloading do about 106GB average. So you can see how big a downside is having to use 2x of bandwidth from the method I know above. The companies I am on do not have DDoS protection that I know of so I am forced to look for external companies to use to connect to the real source.

-So far everyone knows the real source IP but that is because I trust them. Anyone else is waiting to get on it and me looking for ways to put them on.

//hopefully you enjoyed my big paragraphs.

-And what kind of "protection" would I need if only FTP is being used since there is "specialized" kind of filtering on attacks.

View 4 Replies View Related

VPS ( DDoS Protection )

Oct 29, 2007

I was located in, but I was asked to find another hosting because of DDoS attacks on my VPS.



Please move your accounts to some other hosting company. Let us know if you need any further assistance.

Technical Support

I need:

DDoS Protection
RAM: 512 mb - 1024 mb
10-30GB Disk Space
200-300 GB Transfer


View 14 Replies View Related

Hotlink Protection Allow Myself

Aug 15, 2007

Is there a way to enable hotlink protection so that when I edit a page from my computer the pictures from the server display from my server but my site is still protected from other hotlinking. My intent is to make it easier for someone to edit there page.(i know I could just reupload image files but I was trying to think of a way to make it easier for someone else) I thought adding my ip address to the cpanel hotlink protection enabler would do the trick but it hasn't.

View 4 Replies View Related

Passowrd Protection

Apr 6, 2007

wanting to password protect a directory and all FILES and DIRECTORIES under it as well.

I have tried the password protection system in plesk, simply put it doesnt work, sometimes it just doesnt restrict any access and the files can still be downloaded / accessed, and sometimes it asks for a password but even if typing the correct info it sais its a wrong password.

each time i setup the p/w i do it the exact same way, but its random about when it works and when it doesnt.

So, i tried the simple .htaccess way, and i still get the same problem. Can someone reccomend something to me? maybe a free php script that can do this? i need something fairly secure, doesnt need to be some super duper crazy script but at least so people cant just download the file containing the passwords and then they have access.

View 1 Replies View Related

Plesk And Hotlink Protection

Sep 27, 2007

I have a plesk panel and i had a look for hotlink protection but unfortunately couldn`t find the proper option.

I guess there is a hotlink protection at windows version of plesk but not at linux one. I have a linux server.

Also i have a question about hotlinks also, one of my customer has a site that it uses too much bandwith like 600 gb at a month. It is an education related site and site is html.

And i am having some high load issues. When i check apache-status it shows %90 of the connections for that site. But i cant be sure that if it site really makes high load on server because like i told site is html. Also would like to know if server get s load for example if visitor wants to download something from site.

Because visitors are usually downloading zip, mp3 and those kind of files and i dont know if that many download cause the high load.

Also will it reduce the load of the server if i put hotlink protection to that site because of chance for other sites to leech files from this site?

Edit : If there isn`t any option for hotlink protection at Plesk panel how can i enable hotlink protection. Maybe using htaccess, but i would be glad if you can provide hotlink protection code also

View 1 Replies View Related

Copyrights 2005-15, All rights reserved