Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server has been repeatedly attacked in the last few days. Here's the observations:

  1. The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and holds for 10 minutes.
  2. I've got fail2ban turned on, and ICMP echo off. I've got port 80/443, 22 open, and this is an Ubuntu 12 server. The log shows that the incoming traffic is not recorded by nginx or sshd, which means no successful connection to these port were attempted.
  3. I'm pretty positive that I'm not suffering from any kind of data loss, and the server is not hacked.

I understand that this is some form of DDOS attack. I'm wondering if there are any system logs that I can review to find the source of the traffic and the type of attack?

share|improve this question

closed as too broad by Adi, NULLZ, TildalWave, Lucas Kauffman, Terry Chia Aug 18 '13 at 15:21

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

The best way to know definitively is to run tcpdump (or similar) for the next few days, then view the resulting pcaps and see what the traffic looks like. – Anorov Aug 19 '13 at 19:49
up vote 2 down vote accepted

Depending on the type of attack you can either do this with ip tables ( if you are running Linux) or request your ISP to see where the traffic is coming from. The latter is actually the best option as the traffic might contain spoofed IP addresses. Your ISP should be able to locate where the traffic is coming from ( roughly) and see if they can block it using BGP.

You can't do anything against a DDoS locally, once the traffic reaches you it's already way too late.

share|improve this answer
Well, I am running Ubuntu server with iptables, ufw actually. But it appears that the traffic goes through the firewall anyway. And without knowing the type of the traffic, I got no options to strengthen the iptables rules. Is there really nothing I can do locally? Not even make the packets drop between the datacenter switch and my server? – He Shiming Aug 18 '13 at 11:04
The traffic doesn't go through the firewall, even if you drop everything except ports where you run services on. The problem is the traffic reaches you, so your machine receives the traffic and needs to decide what to do with it depending on the rules defined for your firewall. This means you are processing the requests. That's why you can't stop a DDoS with a local firewall and that's why you need to request your ISP to drop the traffic before it reaches you. There are other options like cloudfare which can assist as well. – Lucas Kauffman Aug 18 '13 at 13:49
Thanks for the explanation. I'm clear on this now. But is there a method that could at least provide a log of it so that I don't have to guess? – He Shiming Aug 18 '13 at 14:51
Iptables can log dropped and rejected packages (google it). Do note that if you get 300 Mbit/s this might get a bit hairy as it can full up your disk instantly. – Lucas Kauffman Aug 18 '13 at 14:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.