1

We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information:

  1. All the packet size is same (i.e. 40 bytes)

  2. All different source IPs

  3. Source port is the same for each request (i.e. 1234)

  4. Same destination port (i.e. 80)

Is this a DDoS attack?

Is this a DDos attack? or any other attack signature?

Improve this question
7
  • Need some more information.generally 1234 port number is used by many applications.even some malware like backdoor.ultro uses the same port number. Here is list: speedguide.net/port.php?port=1234
    – Zodiac070495
    Commented Jan 2, 2019 at 8:15
  • Thanks Zodiac070495. I really have little more info to offer. The network is not set up well. There is an Internet facing router outside the firewall and it is significantly slowed. What other info might help? I did look at that list on SpeedGuide. I am wondering about 1234 as the source port. Is there any valid reason why a packet would have that as the source port or only nefarious reasons. Do you think that so many coming from such wide ranging IPs all with the one source port indicates attempted DDoS attack?.
    – Nick
    Commented Jan 2, 2019 at 9:22
  • @Nick,I don't think so these are a DDos attempt because packet size is too small that can be easily handled by the any web server. and one more thing pleases use '@' sign before my name. else I am not getting the notification
    – Zodiac070495
    Commented Jan 2, 2019 at 9:43
  • Thanks again @Zodiac070495 . Most helpful. You can tell I am new to this. Any ideas what kind of issue might cause this traffic?. IPs are from all over the globe.
    – Nick
    Commented Jan 2, 2019 at 11:01
  • @Zodiac070495, I wouldn't say the packet size is relevant to whether or not the attack is a DDoS -- you can either try to overwhelm the pipe with X number of packets (large or small), or you can overwhelm the web server's RAM with the number of simultaneous open sockets. Either way, it achieves the same result. Edit: NMAP can do this scan. The fact that it's coming from a multitude of different source addresses, could indicate a DDoS or could be spoofed (a DDoS doesn't require return-traffic). An IDS, load balancer, and/or dynamic routing could help locally; CDN or cloud for non-local.
    – thepip3r
    Commented Jan 2, 2019 at 20:54

2 Answers 2

Reset to default
2

looking at the traffic pattern, It's a clear SYN Flood attack, a type of DDoS attack which is still prevalent and used by a lot of threat actors. Recently, even Google and Cloudflare DNS servers were affected by this and more on this at https://sissden.eu/blog/darknet-attacks-on-google-and-cloudflare-dns

From remediation standpoint, if your service is critical for your customers, you may try looking at DDoS mitigation providers like Incapsula, Akamai etc. They offer dedicated services along with automated scrubbing technologies which can handle various types of DDoS attacks.

Improve this answer
0
0

in regards to your question. Hard to say whether it's DDoS since it's just small snippet of whole log records. Maybe yes, maybe not. Deeper investigation is needed.

I'd like to ask you :

1) What are trying to achieve?

  • Protect against DDoS?
  • Decrease utilization?
  • Speedup overall packet processing?

2) What does it mean "significantly slowed down"?

  • How many ACL records do you have?
  • What is current a desired CPU/Memory utilization?
  • How many "valid" connections you have/expect over certain period of time (hour/day, etc.) ?
Improve this answer
3
  • Thanks for your reply. I am primarily trying to diagnose the slowing of the system, or at least make some best guesses so I can investigate further. There is no benchmark to compare against. As I said, I have little info. "Some of the router stats given to me show: txload 248/255, rxload 255/255 Input queue: 75/75/788/988 (size/max/drops/flushes); Total output drops: 858895743 Queueing strategy: Per VC Queueing 5 minute input rate 3890000 bits/sec, 2340 packets/sec 5 minute output rate 4690000 bits/sec, 289 packets/sec......
    – Nick
    Commented Jan 3, 2019 at 11:05
  • " 1367558589 packets input, 17925897332 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 75724772 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 131160405 packets output, 3177473036 bytes, 0 underruns 13420839 output errors"
    – Nick
    Commented Jan 3, 2019 at 11:05
  • The part of the firewall log I do have is full of very similar records to those above. I am guessing hundreds each second.
    – Nick
    Commented Jan 3, 2019 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .