0

Say, someone decides to DDOS me. If I'm certain this is happening, how would I go about logging the information done there to submit to the appropriate authorities. As well as who would be the appropriate authorities? IC3? FBI? Country: United States

4
  • Possible dupe: security.stackexchange.com/questions/84540/…
    – Xanmashi
    Aug 16, 2016 at 11:30
  • 2
    The sad truth is, authorities won't care. The best defense against DoS is to have more bandwidth than the attacker or to invest in DoS mitigation services (Cloudflare if you're running a website for example). Aug 16, 2016 at 11:35
  • 1
    If you are certain that it's happening, and it's your personal system as you say, do what you can to get a new IP address. Failing that, contact your ISP's support department. If you have a very good idea where the traffic is coming from, contact that ISP's abuse department (contact details can usually be found in whois).
    – user
    Aug 16, 2016 at 11:51
  • You're asking about DDoS as opposed to DoS, so I would recommend not wasting your time. DDoSes are generally instigated as part of a botnet, where the attacker is attacking you through a network of compromised hosts (who are also victims themselves) to obscure their identity. Even if you did collect information on every endpoint that attacked you, all you'd be reporting on would be a long list of people who themselves were attacked and were compromised. Or you'd be reporting every Tor node on the planet. The only thing you can do is try to withstand the attack; +1 vote for Cloudflare.
    – Ivan
    Aug 16, 2016 at 16:07

2 Answers 2

1

If you are suffering a DDoS, there is only one reporting route that has even the slightest chance of helping:

  • speak to your ISP and see if they are interested. Most aren't.

There is no law enforcement route, as typically a DDoS will be coming from machines in multiple countries all running as part of a BotNet.

You have 3 solutions:

  • Change IP addresses, so you aren't the target any more.
  • Buy more bandwidth so your pipe is bigger than the total bandwidth aimed at you.
  • Buy the services of a DDoS mitigation provider.
-3

You can install the free version Splunk on your personal system. Install the forwarder on that same system and have it log to itself (I am envisioning a laptop; let me know if that is not the case). You can also install Splunk stream and create a workflow action to log all network traffic when a DDoS is detected. You will need to have lots of disk space for all of those logs.

https://www.splunk.com/en_us/download/splunk-light.html

2
  • 2
    Splunk just allows you to collect logs from other apps. You'd still need an actual app to monitor for DoS attacks. Furthermore, if he's a home user behind NAT then his router is what's actually taking the attack - his computer won't even see anything. Aug 16, 2016 at 15:45
  • 1
    @AndréBorie Also, I could see a DDoS quickly eating up the 500mb or whatever of events they allow you to capture on the free tier.
    – Ivan
    Aug 16, 2016 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .