UDP D/DoS Attack - Best Prevention

Apr 27, 2008

I would like to know what are the best ways in preventing a UDP D/DoS Attack. DDoS-Deflate and most programs like that are just for TCP connections, and most of the time only for port 80. What is the best option out there for protection (linux wise) for UDP attacks. I was using shorewall before but it did not do so well so I just switched now to CSF [url] with WebMin and seems to be working ok. Even though thoes are both firewalls, they seem to have some protection against UDP Attacks. Please note this is a server that just hosts some game servers, no webhosting. What would be my best option here?

View 3 Replies


How Can I Prevention From Ddos Attack

May 21, 2007

I have a VPS from hostforweb.com , and my vps every week under ddos attack and 80-150 connection login to apache...

how can i prevention from ddos attack?

View 3 Replies View Related

DDoS Prevention .....

May 13, 2009

I have searched for prevention methods and explanations on what DoS's and DDoS's are capable of. I was hoping someone could shed some light on free alternatives that would help reduce these attacks or help to make me aware if one were to occur.

Linux Distro: CentOS 5.3

I am not running apache or any web related services on my machine.

I run a dedicated server for the sole purpose of hosting a few game servers. I have already contacted my provider and they offered a $599 /mo plan for prevention. This is unreasonable and I simply cannot afford it. I have been threatened with a DDoS because one of my administrators banned a player constantly creating drama, stress, and breaking rules.

I simply cannot afford a gigantic bandwidth bill and this scare tactic has made me a little weary. Is there anything I can do to reduce the damage?

View 8 Replies View Related

How And Which HW Device Do I Need For DDoSS Prevention?

Jan 10, 2007

I have linux server and like to put somekind of DDOS prevention/protection... what kind of device do I need to purcahse to do this?

can anyone advise on this?

View 3 Replies View Related

DDOS Prevention Options

Mar 23, 2009

My host has told me that my forum is coming under a DDOS attack. Once was on Friday March 20th and again today (monday march 23). Before those two, there are attacks almost every week, sometimes twice a week.

The host installed DoS-Deflate. It started blocking legitimate traffic and had to be removed.

The operating system is Linux CentOS, the forum software is VBulletin. The server is a VPS with 1 gig of memory.

Besides DoS-Deflate, what other options are out there?

View 7 Replies View Related

DDoS Prevention By Softlayer

May 20, 2009

any experience with the DDoS prevention feature provided by SoftLayer?

View 6 Replies View Related

Prevention From Server Overload

Oct 27, 2008

Today my server was down cause it was overloaded and when i restart my server its running how to stop such problem in the future

View 10 Replies View Related

Prevention LFI And SQL Injection Attacks

May 12, 2008

i am seeing a lot of Local file inclusion (LFI) and mysql injection attacks quite often directed to php scripts.

what is the way to prevent them? would installing mod_security to apache work?

View 6 Replies View Related

Hotlink Prevention Scripts

May 21, 2008

if anyone knows a script that is url rewrite mods that can fix this hotlink issue by having the link url change every 20 minute.

View 2 Replies View Related

AWStats Exploit Attempt Prevention

Jun 4, 2008

one of my clients seems to be attracting unwanted attention, it seems as if bots or something along those lines are attempting to exploit my box, while they are unsuccessful it would seem. I was wdonering if there was a rule I could put in Mod_Security that would ban them for attempting to

GET "/awstatsf/logger.php?action=log&type=Hybrid&host=hacked101&"

View 0 Replies View Related

Hot Link Prevention And Browser Security

Dec 23, 2007

I recently initiated "Hot Link Prevention" on one of my web sites on my Dedicated server (via CPanel). It woks well in re-directing hotlinked images to a small image that says "Unauthorized Hotlink Image." This of course prevents other web sites from leaching my bandwidth. However, I have had a number of people complain that when they visit my forum, they don't get my site's images, but instead see the Unauthorized Hotlink Image. The common thread seems to be the people with the problem are using Security Software. In one case, a guy is using Norton Confidential. Another guy is using some Security software provided by his ISP. I'm guessing that this security software is somehow messing with the Referer in tehir browser and confusing my server into thinking the images are being hotlinked from some other site. Short of turning off Hot Link Prevention, does anyone have any suggestions to tell the folks...are there settings in their Security Software for example that will prevent the problem when they visit my site?

View 4 Replies View Related

Is This A DOS Attack?

Mar 11, 2008


Mar 10 20:17:55 host kernel: printk: 102 messages suppressed.
Mar 10 20:17:56 host kernel: printk: 3 messages suppressed.
Mar 10 20:18:01 host kernel: printk: 98 messages suppressed.
Mar 10 20:18:35 host kernel: printk: 34 messages suppressed.
Mar 10 20:18:51 host kernel: printk: 189 messages suppressed.
Mar 10 20:18:56 host kernel: printk: 195 messages suppressed.
Mar 10 20:19:02 host kernel: printk: 249 messages suppressed.
Mar 10 20:19:06 host kernel: printk: 36 messages suppressed.
Mar 10 20:19:21 host kernel: printk: 3 messages suppressed.
Mar 10 20:19:26 host kernel: printk: 342 messages suppressed.
Mar 10 20:19:31 host kernel: printk: 509 messages suppressed.
Mar 10 20:19:47 host kernel: printk: 54 messages suppressed.
Mar 10 20:19:51 host kernel: printk: 421 messages suppressed.
Mar 10 20:19:56 host kernel: printk: 542 messages suppressed.
Mar 10 20:20:01 host kernel: printk: 785 messages suppressed.
Mar 10 20:20:16 host kernel: printk: 340 messages suppressed.
Mar 10 20:20:21 host kernel: printk: 337 messages suppressed.
Mar 10 20:20:26 host kernel: printk: 430 messages suppressed.

Or is this something else? It's been going on for about 40 minutes. I seen my load jump to 20, to 100 and back and fourth

View 6 Replies View Related

Under Attack

May 24, 2009

I'm sure that i have Trojans and Viruses on my Server but every time i contacted My Company they ask me to pay money and then they will check and scan my server

so is it any Free application which can scan and remove all bad files on my Server? i'm looking for free applications to scan the whole server

View 5 Replies View Related

SSH Attack

Jul 18, 2009

My server stop responding, I couldn't access via webmin or ssh, and DNS were not responding, so I have to ask for a reboot and now everything is fine.

Looking at the logs I found this:

Jul 18 19:23:12 server sshd[18484]: Failed password for root from port 56817 ssh2
Jul 18 19:23:12 server sshd[18485]: Failed password for root from port 60227 ssh2
Jul 18 19:23:13 server sshd[18488]: Failed password for root from port 38038 ssh2
Jul 18 19:23:15 server sshd[18493]: Failed password for root from port 49884 ssh2
Jul 18 19:24:30 server sshd[18497]: Failed password for root from port 37929 ssh2
Jul 18 19:25:06 server sshd[18521]: Did not receive identification string from
Jul 18 19:25:09 server sshd[18508]: Did not receive identification string from
Jul 18 19:25:14 server sshd[18505]: fatal: Timeout before authentication for UNKNOWN
Jul 18 19:26:00 server sshd[18509]: Did not receive identification string from
And searching that IP on google I found it here: http://www.tcc.edu.tw/netbase/net/in...?fun=240&prd=3

And is flagged as a SSH Attack.

Any ideas why my server stopped working? and how to prevent it?

Im using CentOS 5.0

View 12 Replies View Related

SYN Attack

Jun 11, 2009

i found my site load slowly, the cpu load is good. I run this command
[root@host ~]# netstat -nap |grep SYN |wc -l

It's seem my server is having problem with SYN attack. Is there anyway to protect it ?

I'm running apache 2.

View 14 Replies View Related

Under Attack

May 12, 2009

My site currently in prolong HTTP flood attack since 2 weeks ago. The attack was never stop and for this moment i could only mitigate the attack using my own firewall (hardware).

Since my ISP is not interested to help from upstream, even provide any mitigation services, i could only doing mitigation on my own source or using proxy services alternatively as well, but i've chose to tried on my own. I've tried once on one of well-known mitigation services out there but it seems not fully satisfied me since most of legitimate traffic is blocked from their source.

What i could do now is keep staying alive as well as will not going down on whatever situation becomes worst (but if the attack change to udp attack, i couldn't help myself coz there must be high incoming bandwidth into my network). My network is totaling 10MB last time but since this attack i've been forced to subscribe for 30MB in order to keep balance on the attack.

I've blocked all access except for my country and some other neighbours. If i change policy to allow all countries, the load of firewall will become max and after that hang will hang in less than a minute. I've done load balancing of 4 servers (8GB memory each one) and it seems the condition is getting under control with slight problem of server hang (memory shortage) and very limited keep alive connection.

Now what am i thinking is to buy a router objectively to null route incoming specific IP of countries so i can change my firewall policy to allow all connections as well as to help the firewall itself release its burden halting blocked IP that currently keep hitting itself that could might impact its performance.

Which brands of router is possible doing this thing?

Do you have some other suggestions instead of buying router?

View 8 Replies View Related

SYN Attack

Apr 12, 2008

i am just having one issue in one of my highly visited website hangibar.com, its being hosted in softlayer, we are facing synattack too much in this website.

the solution which microsoft given in their website related with tcp/ip registry entry but thing is same , some where and some connections become increases too much over tcp/ip. due to that reason website become very sticky and it stop functioning the execution of sql process, during this issue i have to restart the server to establish a fresh connection.

View 3 Replies View Related

Syn Attack

Dec 9, 2008

im getting a syn attack and my vps getting overloaded what im doing is banning ip's that gets most connections

after banning server get normal but if there anyway to stop this post method

View 11 Replies View Related

DOS Attack And APF

Oct 30, 2008

My server is under dos attack (http) , I have installed APF firewall and ddos deflate. I configure them to work together.

now if any IP with more than 100 connections is black listed by dos deflate, I can see it in apf's deny_hosts.rules file.

everything seems correct, but my server still very slow.

the ip which is causing that has more than 1000 request and is blacklisted.

View 11 Replies View Related

I Am Under Attack

May 15, 2007

There are lot of perl process with 100% usage on server. When i tried to view error_log it shows following:

[root@local ~]# tail -f /var/log/httpd/error_log
=> `Lnx.txt'
Resolving gihkus.com...
Connecting to gihkus.com||:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16,577 (16K) [text/plain]

0K .......... ...... 100% 316.78 KB/s

05:26:03 (316.78 KB/s) - `Lnx.txt' saved [16577/16577]

When i tried to view this http://gihkus.com/Lnx.txt it seems to be attack on my server. http://gihkus.com/Lnx.txt is not hosted by us. I have disabled perl support on all domains hosted on our server but still we are under attack. There is nothing special in /tmp.

View 6 Replies View Related

Possible Attack

Jan 4, 2007

Over the past day one of my servers has seen a huge rise in incomming traffic (from normal web requests to a constant 4Mbit/s, peaking upto 80Mbit/s). My outgoing traffic has remained at its normal profile, so I am pretty sure that these are not web requests, and it does not seem to be having an adverse effect on the server (the site still runs perfectly well and quick and load is still less than 1).

However, I am unsure as to how to identify what this traffic is? Are there any easy ways to tell on a FreeBSD server what the source and type of incomming traffic is? I have tried playing with netstat, but an not getting anything useful - I would like to see which ports are involved.

View 6 Replies View Related

Dos Attack

Jul 15, 2007

Am Really suffering here for ddos attack ( apache - pop3 ) every week my server under attack am using APF but now am really wanna get red from it am looking for a powerfull firewall I do not know if CSF Could stop this attack like limiting receiving SYN from an ip or any other policy another thing . i have get this rules from forums but am really weak at iptables rules so can any one help my if these rules useful or not . against Dos attack:

iptables -t nat -N syn-flood
iptables -t nat -A syn-flood -m limit --limit 12/s --limit-burst 24 -j RETURN
iptables -t nat -A syn-flood -j DROP
iptables -t nat -A PREROUTING -i eth0 -d (dest ip) -p tcp --syn -j syn-flood

View 7 Replies View Related

DDOS Attack

May 29, 2009

My server is using too many httpd process..I think iam under DDOs attack..I executed the following command..

netstat -an | grep :80 | sort
and the result is this

tcp 0 1491 ::ffff: ::ffff: LAST_ACK
tcp 0 1493 ::ffff: ::ffff: LAST_ACK
tcp ....

View 14 Replies View Related

Is This A DDoS Attack?

Aug 4, 2009

I have a windows server, and today it has a large inbound traffic, so I tried to disable all web service, and after that, the result of netstat -an shows no connection at all, but the server still has large inbound traffic,

Do you have any idea about this?

What should I do now?

View 8 Replies View Related

DDOS Attack Help

Mar 19, 2008

Our server is in attack since 4 days. Http port busy all the time.

When I type :

netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut -d: -f1 | sort -n| uniq -c | sort -n | tail -5

It shows :

[root@ ~]# netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut
-d: -f1 | sort -n| uniq -c | sort -n | tail -5
[root@ ~]#

I wonder the hidden IP of 5128 ??? How to know it?

View 8 Replies View Related

Am I Under DDOS Attack?

Jun 21, 2007

The server getting slow with high I/O diskwait then normal, although load is not high.

here is the output of: netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n .................

View 6 Replies View Related

Ddos Attack On VPS

Apr 12, 2009

i had installed anti ddos or firewall,but those are useless.His attacks are such great that The server and all the vps are down now. One told me that I should check the ips and receive ips. The attacker is so skillful .describe the best method to defeat him. Be sides the attacker use diffirenet ips in each attack,I block him by iptables but no use…. His attack occupy all the ram and I have to resetart the server… Now this time his attack lead to shutting all the vps down

View 10 Replies View Related

Under Ddos Attack

Jan 6, 2009

My website is under ddos attack from some competitors. I don't know yet how big is the attack. The ips of the ddos attack come from all the world.

I have contacted a few hosting companies specialised in ddos proof hosting, unfortunatly the price is so expensive that i cannot afford it.

So i try to find another solution : my website is only aimed to the french people, so maybe is it possible to install a kind of firewall or proxy located before the server to block all the incoming IP adress not from france ? Do you know some websites who can do this and the price ?

I already try do deny the non-french ip in one htaccess file but the ddos attack saturate the server anyway.

View 11 Replies View Related

SYN Flood Attack

Jul 28, 2009

We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.

Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.

Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)

View 5 Replies View Related

SYN Flood Attack

May 3, 2009

someone decided to attack my webserver and I can't figure out how to block it.

tcp 0 0 localhost:80 SYN_RECV
tcp 0 0 localhost:80 SYN_RECV
tcp 0 0 localhost:80 SYN_RECV

It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.

We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.

Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.

View 14 Replies View Related

Copyrights 2005-15 www.BigResource.com, All rights reserved