Tag Info

New answers tagged

0

You can easily set iptables rules in your firewall to filter the connexions you want and block the undesired ones. You can use your firewall in conjunction with Fail2ban that will help your server (where you hosted your website) in order to update your iptables rules and reject suspicious IP addresses.


1

You simply can't protect your website from illegetimate requests like this. Consider moving your site behind a service which does packet scrubbing and verifies the legitimacy of the connection. One free service you could have a look at is CloudFlare.


1

Your link goes down about 3 minutes after the "intrusion" has been detected. It's highly unlikely that the disconnect has been caused by one of these network packets. The packets look like regular scans (SYN packet to TCP port 22 - that's a classic, the other is a proxy scan - looking for squid at 3128), I have serious reservations that this is something ...


1

This is really stating the obvious, but if you're the one configuring packet dropping, the packets will be dropped at wherever you configure them to be dropped. You'd usually have a number of options, such as your gateway router, your firewall, your load balancer, or your server if the server has a host-based firewall. If they are dropped at my server, ...


2

You're correct that if the packets are reaching your server that the attack has succeeded, mostly. Many businesses will purchase DDOS protection from a company that will drop such packets for you before they reach your precious pipes. One such company and how the service works, very broadly. https://www.cloudflare.com/overview


2

Ichilov's answer is more relevant. Two non-vulnerable SSL Attacks Send garbage data in place of pre-master secret (SSL Handshake flood) Continuously re-negotiate the per-master secret from the handshake again & again Hope Ichilov's explination is quite enough Mitigation: Client puzzle can help to mitigate DDoS attacks. The client puzzle mechanism ...


0

As you are running VM's you should just check the VM's firewall, bandwidth and CPU graphs as they will most likely show a spike, then you will know what client to blame. If you have screwed up and don't have any resource monitoring set up (and therefore don't know how it occurred) then you should probably just wipe the server to be sure and start over, and ...


0

I'm assuming that because these spammers have my URL, they will keep hitting my site no matter what server I'm on, correct? That's correct. Those 60 visits a day should really not be a problem, either your page are doing some insanely heavy operations on each pageload or your host is trash. What steps should I take to prevent these unwanted ...


0

As far as DDoS mitigation goes, simply changing your domain name isn't going to help. It's kind of like playing a shell game, "whoops I moved here", and it won't take long for the bots to again hone in upon your new hosting provider. Essentially any open port on any public IP will be receive bot/scan traffic, so a security-through-obscurity solution is ...


1

Full disclosure, I work for a DDoS mitigation company protects companies against DDoS attacks. A few ways you can dodge DDoSers can be through blocking the attackers by IP or country. Blocking by IP will block access from those specific attackers, so long as they're trying to access your site via that IP, they will be blocked. Blocking by country can also ...


3

Full disclosure, I work for a company that develops DDoS mitigation and web application firewall services DNS amplification is a Distributed Denial of Service (DDoS) attack in which the attacker exploits vulnerabilities in domain name system (DNS) servers to turn initially small queries into much larger payloads, which are used to bring down the victim’s ...


0

Can't we, as a web owner, resolve issue by ourselves? No, simply because you have less bandwidth than your upstream provider... who may have less than a DDoS mitigation service. The attackers throw lots of bandwidth-consuming traffic at you - if you're paying for a 100 Mbps Internet connection, and they throw 1 Gbps traffic at you, you'll be overloaded ...


-3

You can mitigate 99% of the DDOS attacks yourself with a front end load balancer


2

CloudFlare works very well. You can learn more about what they actually do to protect your site from this talk: https://www.youtube.com/watch?v=w04ZAXftQ_Y It's not really possible to deal with such attacks on your own. Maybe in the earlier times, when such attacks were not very sophisticated, you could block off some traffic with your firewall, but now ...


3

Distributed Denial of Service attacks work because they use multiple (sometimes thousands) of hosts sending traffic to your site to overwhelm your resources. This is not something you, as the target, can remedy. Cloud services, like the ones you mentioned, modify and limit the traffic to your site, and to do that, they need access along the path between your ...


-3

Yes, they work. No you cannot generally solve this yourself, but there are things you can do to mitigate SOME of the problem.


2

Ping of Death, Teardrop etc. were local attacks for broken TCP/IP stack implementations and caused affected systems to crash (mostly in late 90-ties). Smurf in an example of distributed (DDoS) attack, which uses ICMP Echo Request with spoofed address to cause victim systems to be flooded by ICMP Echo Reply packets. TCP SYN flood is an attack to overflow ...



Top 50 recent answers are included