How To Prevent DNS Flood

May 28, 2008

Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?

View 7 Replies


Syn Flood

May 11, 2009

I've been getting a syn flood for the last week or so.

I've pretty much tried everything I could online but have been unsuccessful in stopping them.

I talked to the data center techs and they basically can't put a stop to it either.

Here's a very small portion of my netstat

tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -
tcp 0 0 SYN_RECV -

root@xxx [/]# netstat -nap |grep SYN |wc -l

The IP's change often and it's not possible to narrow it down.

So far the things I have done;

syn cookies enabled

reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv

echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max

installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.

The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.

View 6 Replies View Related

SYN Flood Attack

Jul 28, 2009

We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.

Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.

Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)

View 5 Replies View Related

SYN Flood Attack

May 3, 2009

someone decided to attack my webserver and I can't figure out how to block it.

tcp 0 0 localhost:80 SYN_RECV
tcp 0 0 localhost:80 SYN_RECV
tcp 0 0 localhost:80 SYN_RECV

It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.

We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.

Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.

View 14 Replies View Related

How Can I Best Work With A Syn Flood?

Jun 11, 2008

How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.

If I get a few servers, how would I have it setup to best defend?

View 6 Replies View Related

Syn Flood Protection

Jul 25, 2008

one of my server were hit by massive ddos syn atack. target was port 80-apache

i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?

View 1 Replies View Related

Connection Flood

Mar 8, 2008

I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.

netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n


348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.

View 10 Replies View Related

Does Keepalive Off Help In Syn Flood

May 29, 2008

Does keepalive off help in syn flood?

View 6 Replies View Related

How To Detect Flood Ftp

May 4, 2008

My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.

how to Detect flood ftp.

View 4 Replies View Related

UDP Flood And Bandwidth

Apr 4, 2008

We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.

View 6 Replies View Related

SYN Flood .. No Way To Stop It ?

Oct 30, 2007

One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.

Isn't there any solution (software-hardware) to stop that ?

View 14 Replies View Related

Ddos Attacks / Udp Flood

Jun 25, 2008

one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.

View 3 Replies View Related

Flood In FTP And Brute Force

Oct 27, 2008

flood in FTP and brute force

all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:

/etc/apf/apf -d {bfd.pure-ftpd}
The following are event logs from on service pure-ftpd (all time stamps are GMT -0500):

Oct 25 13:52:37 svr1 pure-ftpd: (?@ [INFO] New connection from
Oct 25 13:52:37 svr1 pure-ftpd: (?@ [INFO] New connection from
Oct 25 13:52:38 svr1 pure-ftpd: (?@ [WARNING] Authentication failed for user [router] ....

View 0 Replies View Related

Robots Flood My Server

Jul 26, 2009

I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.

I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.

Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.

I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.

So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...

what to do so these connections quit jamming my server up? It's like a very very slow DOS...

View 3 Replies View Related

Flood Connections On Port 80

Aug 1, 2007

When I check on port 80 connections, I get a list of few IPs with more than 100 connections.

I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?

View 3 Replies View Related

Inbound SYN Flood Attack

Jan 11, 2007

my server under attack with syn flood and i attach the active connection during attack

View 2 Replies View Related

How To Secure Your Web From FLOOD ; Ddos ; Etc

Jun 20, 2007

some of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !

how can we save him from these attacks?

else the firewall!

1- is there any program or script to prevent these attacks!

2- is there any rules or script's for Firewall to prevent it!

View 4 Replies View Related

Apache :: Flood Of 302s After Redirect

Jun 5, 2015

I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do

View 10 Replies View Related

How To Prevent Rm -rf /

Jul 4, 2009

Does anyone know anyway that "rm -rf /" can be disabled? OR any selinux rule or something to prevent this?

Or if I wanted to prevent a certain directory from being deleted like backups but something unlike chattr that someone can figure out quickly.

Im sure LOTS of people would like to know about this. Ive searched around and only somewhat useful thing I have found is an rm wrapper that sends everything to a trash file in the root of the mount point.

View 14 Replies View Related

Prevent Phishing

Jun 1, 2008

I'm not that techy I'd like to ask why this person downloaded the file below before uploading some phishing webpages on my account ? I've changed my password numerious times from different computers and even from mobile phone just to check if the person can still get in. But again it is no use the person were able to upload phishing pages.


May 25 21:50:42 server100 pure-ftpd: (weblogin100@ [NOTICE] /home/weblogin100//.htpasswds/update/Login.php downloaded (21251 bytes, 755.78KB/sec)

Right now I deleted all other scripts on the account and remain some htmls. Folder were also set to 644 no 777, while waiting if the person can still upload his phishing pages please help me why he downloaded the file above. I've check the file on my account and I cannot see Login.php. By the way I have a root login and only two accounts were a constant phishing victims.

View 1 Replies View Related

How Prevent Hackers Away

Feb 21, 2007

I am giving few tips on securing your server against hack attempts. You must check these inspite of other securities like firewall, rootkits detectors etc.

1. Most Important, do not disable safe_mode under php.ini. If any customer asks to disable it, turn it off on his account only, not on whole server.

As most of the time attack is done using shellc99 (phpshell) script. In case safe_mode is off on server and there are public dirs with 777 permission, he can easily hack through.

2. Compile apache with safe mode as well.

3. In cpanel under tweek settings, turn on base_dir, if someone requests to turn off, turn it off on his/her account only. As using phpshell one can easily move to main server dirs like /etc, /home.

4. Do not allow Anonymous Ftp on your server. You can turn it off from ftp config under WHM Service Configuration. If its allowed, one can easily bind port using nc tool with your server and gain root access. Always keep it disabled.

5. Make sure /tmp is secured. You can easily do that by running this command /scripts/securetmp using ssh. But do make sure, /tmp is secured. Else one can upload some kind of perl script in /tmp dir and can deface or damage all data on the few/all accounts on your server.

keeping your server secure from hack attempts.

View 7 Replies View Related

Prevent Php Script Run As .gif Or .jpg

Oct 28, 2007

Does anyone know how to prevent some shell, php script change file name from file.php to file.jpg or file.gif and upload to server and run it to attack server?

View 14 Replies View Related

Prevent Ddos

Sep 11, 2007

from 2 days ago until now my server be ddos and i stay in my computer and block ip but it is not finish is a program to do block ip automatic?

View 2 Replies View Related

Prevent IPs Unallocated IPs Being Used

Sep 13, 2007

We have been using our L2 switches functionality to only allow IPs that are assigned to a particular server to be accessed for sometime. However, the latest version of this particular switch no longer includes this feature. Moreoever, it is quite a labor intensive task which is not good for "budget" servers.

I am considering moving the rules to the main router, but am afraid of the scalability of this. Will it hold up with a few 1000 servers?

How are other hosties going about this? I have heard that some just don't bother at all, which leaves their clients open to having their IPs duplicated by others on the same subnet. This can't be good....

View 1 Replies View Related

Prevent Mass Download

Sep 21, 2006

i need any thing to prevent mass download

my server is cost a huge bandwidht monthly . because mass downloading?

View 1 Replies View Related

Prevent From Iframe Virus

May 24, 2008

I need to know so idea, how to prevent iframe virus injection into the server,also is there is any mod which help in protection for iframe virus.

View 14 Replies View Related

How To Prevent Nobody To Move In Server

Jun 13, 2009

i have my own box for my forum .. now i shared my box with friend's , but in reall they a freak friend's , just to be in safe brother, am looking to know what function i can disable in php.ini or any problem/tool to prevent anybody / attacker * nobody* permission to move in the server via his shell script..

as we know some attacker's use them own php-shell to hack site's * shared hosting *, so they can move to any account after they know the user account name * /etc/passwd * .. so as i say before is there any good functions to prevent these attacker to move in the server? so i can disable it .. or install any good tool * else modsecurity * in the system to prevent them *nobody* of that?

View 7 Replies View Related

Mod_security To Prevent Some Script

Jul 30, 2009

I try to use mod_security to prevent some script in some files,

imagine I want to block all scripts includes "test" in the body

so if code of script.php is:

HTML Code:

and someone run script.php , I want block running and show 406 error

now can you tell me how can I write this rule in mod_security 2 with apache 2?

I use SecRule RESPONSE_BODY "test" but its now working ...

View 8 Replies View Related

How To Prevent Perl From Working

Jan 12, 2008

I have a cPanel/Linux server, runing apache as a webserver.

i want to know how can i prevent perl/cgi files from working on all virtual hosts on both apache2/apache1.3!

View 14 Replies View Related

What Can I Do To Prevent DDoS Attack

Aug 4, 2008

My site was recently under a DDoS attack and was down for a few days, the attack came from Russia i believe.

The people who did it asked for $800, but of course i didnt pay. My hosting company did the best they could in order to stop the attack but it still lasted a few days and badly hurt my rankings.

I moved my site to a dedicated server, but i dont know what kind of software/hardware i need to install on it in order to prevent more future attacks, the hosting company suggested a few things but i dont know if they are just trying to get more money out of me.

View 3 Replies View Related

Copyrights 2005-15, All rights reserved