New answers tagged ddos
When I had this problem, all I did was add a couple of entries to my IP tables. If you are running linux, then this is really simple. Run this command for each of the offending ip addresses: iptables -A INPUT -s IP-ADDRESS -j DROP http://www.cyberciti.biz/faq/how-do-i-block-an-ip-on-my-linux-server/ This will make sure all packets that come from those ...
if it is a layer 7 (d)dos and your application is badly designed or eats up resources quickly, then, yes it is possible to dos your server with a simple perftest-tool. oh, and the good thing is: you can test yourself.
Yes they could. JMeter is distributed - the load can be injected by multiple slave servers controlled by the master controller server making it possible for a DDoS attack to be executed: This diagram shows a local IP range, but there is no reason that this could not be distributed over the internet. This means that a single, powerful sever is not needed. ...
DDOS (Distributed Denail Of Service) implies that the the attack is distributed, meaning from many sources. So by definition one cannot DDOS from a single source. If the traffic came from one source it would be a DOS (Denail Of Service) attack. Yes, someone could possibly DOS you from a single source but it would have to be a very powerful server to bring ...
Blocking all originating traffic with source port 53 will not solve your issue. DNS Amplification attack is sort of a volumatric DDOS attack, no matter how good your firewall can block/handle the bad traffic, your pipeline will still be bursted. You want to block the DNS spoof traffics as close to the internet edge as possible. Try contact the ISP for ...
My guess is you (or someone else on your server) is doing SSH proxy tunneling and connecting to stackexchange or another site using gravitar, and for some reason those connections to gravatar were timing out. I do not think my home server is hacked and I see similar messages in my auth.log, but only on days when I was using the SSH proxy. The messages are ...
this is a usual open-proxy-scan ("GET http://..." instead of a npormal GET - Request like "GET /index.html") which is answered by a 404 - Not -Found-Error from your server, so no need for action from your site
It seems "they" are trying to get different ads through your server - expecting it to behave as an HTTP proxy server. (Maybe your was misconfigured before to be an open proxy.) Instead of sending a: GET /filename.php HTTP/1.1 They're sending a GET http://adhost.com/dir/file HTTP/1.1 This way, "they" will be able to render many ads for their ...
This is normal fingerprint scan. Various tools sent direct/odd looking GET requests. It is usually done to detect the type of server and other information. There is no real "magic" here. It can be faked.
The first port of call might be to take a packet dump (ie, tcpdump) and see what it is you're throwing out.
Top 50 recent answers are included