My server has been repeatedly attacked in the last few days. Here's the observations:
- The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and holds for 10 minutes.
- I've got fail2ban turned on, and ICMP echo off. I've got port 80/443, 22 open, and this is an Ubuntu 12 server. The log shows that the incoming traffic is not recorded by nginx or sshd, which means no successful connection to these port were attempted.
- I'm pretty positive that I'm not suffering from any kind of data loss, and the server is not hacked.
I understand that this is some form of DDOS attack. I'm wondering if there are any system logs that I can review to find the source of the traffic and the type of attack?