Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

Recently my server has been attacked multiple times, after looking at my firewall I've come to the conclusion that the IP's are spoofed. (10,000+ IP's connect at once)

I'm running Win server 2012 x64 (can't go to Linux because some of my programs require Windows)

The attack usually is around 800MBps - 1GBps

My question is, is there any way to prevent a spoofed DDoS/SSYN attack and/or find the source the attack originated from? I've done some research and I can't seem to find anything about it.

Here's a typical packet from one of the thousands of IP's that flood my server during an attack:

10:45:21 An incoming packet(Blocked) Protocol: UDP, Source port: 36851, Destination port: 46662
EI  ×moÿõ º£!yàØ»ÄææOvO>MÔ„`^PðM„µS²zEÔÍì7âˆ(_Ž±¹ð4ñÆT~³sJ˜áÌ·'âz…ÞUæ÷z¯p
L_ùÌÆâY‰âó©pé€eáÅ£.#...Ò."...SSIP+D2U._sip_udpiscorg.ÆQ.....Ò.›... Qž¡QwÃ\iscorg.”À{«Ÿ_`D*¥l×ÚØ]ÙŒṮ~Éw.ÃÐÁaË1Ïè°öSµ*r±{û¤$
ŽüócÊ.§!BÏêؑׄ¨4Ÿ.‹Û×âeå’‰þ'ë/[–úÌ®‚CŸœWo@¨Ë2àäÜòl£d‡+.²þ´eðûAü%8vÈÞ=nsÆx....Ò. ø..........
Æx.....Ò.›... Qž¡QwÃ\iscorg.­™4U­¸ÁQ˜q’ü¬´¤…ÕÎnÆ€g9²“Ûˆì¯b<þ€”'#(4À²5- 7+â\Nb­  ΀®Ðþ¶ÀÙL°e/Y‰!rÌÄÿ8Šcµ9ñt¡ÿu`q!D,[AjáÖyÆÿž&ö~B1¹mºÂÑ¢"&UUW…÷öõÇ;....Ò.dcv=spf1 a mx ip4:204.152.184.0/21 ip4:149.20.0.0/16 ip6:2001:04F8::0/32 ip6:2001:500:60::65/128 ~allÇ;....Ò.54$Id: isc.org,v 1.1795 2013-04-23 00:33:52 bind Exp $Ç;.....Ò.›... Qž¡QwÃ\iscorg.YÅÇ
¤JÐ@Ç78ôžK
Îê‡î]à]óÝüÓÕ&ãÌJä@ˆK¸l´<Ln—WûÛÂÃñðFPlìÓfòfŽý”.;ð£m{ ¨rH… -c‘ü<üVŠ½êùKEG•‹Æžˆ³:mHÆ]Ï?«o ³ã6èÙÆQKÎÈ“....Ò..
mxams1È“È“....Ò..
mxpao1È“È“.....Ò.›... Qž¡QwÃ\iscorg.Ž5Ž“Yñ
.&¡ÞbXÁùãE.›
Ãùµ\ëÍù²Kÿ©Ãfšp’ÿ8>ôûk“{°FÞRWŒá@EÁöa6b4³    Æ…=šPŒxwë–®š­gÝŸâÕ§ÕK¹S‡þøÄ0¡dç$«kžv,·pœáØ|;Ò>»Ï¤à¸ùíÉj....Ò.•@*Éj.....Ò.›... Qž¡QwÃ\iscorg.‰¹›´qÏùû†ÈA$aŒ9eú Ýëá“yUܼÌaç>ŽC¬¹Ôââ¿Wª«åöR:øŒàV™ôÁR¼^ßQW£YÔr²æáò¬Ž¨•t²Ð®2b˜æË[{@knk›»òÒpÀ¢u]‡ÏèÉlŽHœá<ï¾Oÿ×[³$ýŽŽÊ!.....Ò.›... Qž¡QwÃ\iscorg.l    99éŠükQ”ˆ‹qG~<ÒÜÚèØÍ/ÞKTªeKÌÊZ⧅Է¬ ÏöžtÊÏWRå‡iѨq¤RêKA/£- Ò¥Ts]AÀ¹uýù‚J½æž.¦$¬qÕú5dNÈ]»à†ê£ÐíN$(8ŠL¡ÌÄt)öbîÑtGÊÈ....Ò.*ns-intÊÈ
hostmasterÊÈwü–à.. ..z^€..Ê

I can make out a few things from the packet like afillias-nst.info but that doesn't help me at all.

I'd appreciate any advice.

share|improve this question
    
Closed. This one is quite localised, hence the downvotes, probably. I have linked as dupe of a more general case, but Terry's answer is still good - DDoS mitigation providers like CloudFlare, Prolexic, Akamai and others are the real way to solve most of these issues. –  Rory Alsop Apr 28 '13 at 20:13
add comment

marked as duplicate by Rory Alsop Apr 28 '13 at 20:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

The only sane protection against DDoS attacks is deploying a service like CloudFlare.

The very nature of a DDoS attack makes it difficult to detect and stop. How are you going to distinguish between malicious and normal traffic? Even if you have such a means, performing analysis on every single connect attempt on your server is probably going to overload whatever router or firewall you have.

Cloudflare uses anycast technology to spread the traffic between many different endpoints located around the world. This "thins" out the traffic enough so that your site can stay afloat during a DDoS attack.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.