I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP requests whereas HTTPS requests are fairly good (not as good as expected though).
By doing a bit of analysis and looking at the
dmesg and the growing size of apache's
error.log (over 5GB), I found out that hey I'm receiving a DDoS attack.
I shutdown Apache and did a
netstat, I found out that all the
SYN flood is gone.
The problem was that remote servers were initiation requests to Apache on port 80 and would leave the tcp connection open and thus exhausting Apache's resources.
What I did:
I checked if I had any Apache updates, but I was up to date.
To make sure that my server did not run a bot to communicate with a command and control server, I replaced the current volume image with a very old one at the time I did not have any problems. As soon as I started the server, I received the attacks as before, so this wasn't an issue.
I installed CSF, although I was hesitated because I could not initially trust this software. After starting CSF's
SYN flood prevention, I noticed some improvement on HTTP requests but not much.
What I finally did was to change the IP of the server and the attack was gone. By the way,
iptables rules were not that effective, because I ended up blocking legitimate traffic.
What's still a question for me:
- Why HTTPS requests were being handled in a timely manner?
- Why servers are still easily vulnerable to such attacks despite tons of research in this area?
- How can I prevent this problem in future?