Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.

The server is being ddosed since 8 months ago till today. I've tried to talk with the server provider but they couldn't help me.

When the server is under attack, the remote desktop is down, and so is the webserver and server console, and I need to talk with the provider to tell them to restart my server.

Could I add a program or something to trace the activity and to identify the type of attack (the source) then block it?

share|improve this question
2  
How do you know you have a DDOS attack rather than some other problem? If it is DDOS, then of course there is not just one source to block... – David M May 17 '12 at 15:57
That's the problem , I'm just assume it's ddos , I don't know what to do to find the source of the attack – Jax May 17 '12 at 16:01
1  
So all you really know is that you have an outage that requires a reboot. Start by checking all the log files on the server for information that might point you to the cause. – David M May 17 '12 at 16:02
The logs are clean .I've tried that – Jax May 17 '12 at 16:03
Oh It seems In Administrative events I have a lot of lines with the same thing : Category: Emergent Alarm, Type: Start UDP Flooding attack protection, Parameters: Packets Count=100, Protocol=6, DestPort=5816, Dest IP=my ip – Jax May 17 '12 at 16:09
show 7 more comments

4 Answers

up vote 3 down vote

Are you sure this is a real DDoS? Over an 8 month period you would think that the "attackers" would find something better to do. Did you implement an update in the game around that time that causes it to fail an authentication procedure or something similar?

you can disable UDP as per this answer, however note the answerer's warning

"I've NEVER encountered a situation where turning off UDP was a good idea. It seems like you're trying to secure your system by randomly turning things off, without understanding what you're doing, or how security works. Please don't."

share|improve this answer
up vote 3 down vote

DDOS attacks almost always come from different machines all around the world! So, It is better to use a service like Cloudflare or a Firewall, both of which check the Browsers before accessing your Server...

Thus, it is better to prevent from being DDOSed in this way, rather than checking which sources caused it!

I hope I helped you!

share|improve this answer
up vote 0 down vote

Blocking traffic on the server will generally not fix a DDoS problem; you need to block the traffic upstream. If the DDoS traffic looks the same as legitimate traffic, then you're going to need to out-scale the attack by moving your system into the cloud (or some other measure). If the DDoS traffic looks different (different port, specific source address(es)), you can ask your service provider to get them to block the traffic.

What does the traffic actually look like? Have you looked?

Do not block all UDP; that's not smart. DNS uses UDP.

share|improve this answer
up vote -3 down vote

you can use the concept of bandwidth throttling and capping depends upon you, how you are going to manage.

Bandwidth throttling means you are going to restrict the server how much data it will accept. there is one project on google http://ultramegabit.com/file/details/-XskwK704PI this concept used by isp's to overcome from server crash or overloading

Capping has opposite meaning, in this you will use the bandwidth when available. These two methods only prevent server crash.

For tracing and preventing DDOS you have to check the server logs i.e if you are getting more web request then you check your apache log. From there you will get some clue but in this case false positive will be there.

Best way is harden your os.

share|improve this answer
1  
Hardening your OS does not mitigate a sufficiently sized DDoS. – D3C4FF May 13 at 5:52
I'm sorry, but you don't seem to understand what DDoS is. None of what you suggest would do anything to defend against or help prevent such events in the future. Detection is beyond the point tho, it's rather obvious when it's time you need to worry about being DDoS-ed and having a look into one's Apache logs certainly won't help determine which requests are from the attacker, and which aren't. That's the whole point of DDoS - it looks like normal requests, but in to the server unmanageable numbers. – TildalWave May 13 at 5:55
hardening os will remove the security flaws that is known to outside world. DDoS attack can be detected by using logs because you can see the behaviour of that ip means how much time they have requested but requires learning. – raghav mishra May 13 at 6:17
DDoS has nothing to do with security flaws; it's just an unmanageable flood of traffic. Also, it's not just one IP - that first D stands for Distributed... – anaximander May 13 at 15:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.