Tag Info

New answers tagged

2

as @GZBK said, this happens because for whatever reason, people are being sent to your server when they try to open those sites. This has happened to many others, and is likely the GFW doing its dirty thing. Here is a nice post about some other guy who had the same thing happen to him. You can use this site to check if the dns is pointed to your server.


3

Since GZBK covered why, I will cover the single simple solution to minimize this and related problems that I and others such as StevenC use. Make your first or default virtual host small fast and light, returning errors on all requests (I have been known to allow a basic css and related resources). This has the advantage of minimizing resource consumption, ...


10

When you type the URL in your browser, the browser will mainly do two things with it: Resolve the host name to get the associated IP address to be contacted, this allow the browser to send the request to the right server, Put the host name which has been actually typed in the Host HTTP header, this allows the server to send an appropriate reply in case ...


0

A DDoS attacks basically means the connection to your computer is saturated. There are several ways to do this but the result is the same: nobody can access your router and you may possibly not be able to go on Internet (roughly speaking). No hacking is involved, once the DDoS stops you recover (you many need to reboot your router). So this is not "hacking" ...


0

I would say that DoS attacks are significantly more common, I should also point out that a packet flood is not the only form of DoS / DDoS attack. For example, I know of a fairly popular php product ( a Video encoding / gallery product, not going to name names since this is still undisclosed) which even in its current revision can be massaged correctly ...


0

No. A DDoS attack would be generating thousands of log entries per second, not three entries over the course of 20 minutes. Like usual, your router is simply presenting minor events in the most alarming language possible to scare you into thinking it's doing something.


1

Based on the timestamps (1min 46sec & ~15min gaps between events), this is not a DDoS. This is about par for random DoS attempts against an exposed device on the Internet, such as your Netgear router. A DDoS would show many events flooding in at the same time... you would get lots of logged events per second, or at the very least hundreds per minute.


10

Ignoring packets is cheap, but if your connection is unable to handle the sheer volume of traffic per second then you're going to fall down hard. The only answer at that point is to filter traffic upstream of you. Because things are distributed and high performance routers really don't like consulting a large routing table just to play whack-a-mole on which ...


2

All a denial of service attack (of which a DDoS is a specific type) does is deny legitimate users access to the site. Anything further is a separate attack. Any repercussions are just those arising from the site no longer being accessible to legitimate users for a time (availability being one of the three pillars of security, which is why this is a security ...


1

Detection is fairly easy and a well-known problem that your security and incident event monitoring solutions (SIEM) should be able to shine light on, AlienVault (OSSIM) is an example of such a solution, as is Prelude, via event correlation. It's worth keeping up on correlation as an art unto itself: ...



Top 50 recent answers are included