I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.

The server is being ddosed since 8 months ago till today. I've tried to talk with the server provider but they couldn't help me.

When the server is under attack, the remote desktop is down, and so is the webserver and server console, and I need to talk with the provider to tell them to restart my server.

Could I add a program or something to trace the activity and to identify the type of attack (the source) then block it?

  • 2
    How do you know you have a DDOS attack rather than some other problem? If it is DDOS, then of course there is not just one source to block...
    – David M
    May 17, 2012 at 15:57
  • That's the problem , I'm just assume it's ddos , I don't know what to do to find the source of the attack
    – Jax
    May 17, 2012 at 16:01
  • 1
    So all you really know is that you have an outage that requires a reboot. Start by checking all the log files on the server for information that might point you to the cause.
    – David M
    May 17, 2012 at 16:02
  • The logs are clean .I've tried that
    – Jax
    May 17, 2012 at 16:03
  • Oh It seems In Administrative events I have a lot of lines with the same thing : Category: Emergent Alarm, Type: Start UDP Flooding attack protection, Parameters: Packets Count=100, Protocol=6, DestPort=5816, Dest IP=my ip
    – Jax
    May 17, 2012 at 16:09

5 Answers 5


Are you sure this is a real DDoS? Over an 8 month period you would think that the "attackers" would find something better to do. Did you implement an update in the game around that time that causes it to fail an authentication procedure or something similar?

you can disable UDP as per this answer, however note the answerer's warning

"I've NEVER encountered a situation where turning off UDP was a good idea. It seems like you're trying to secure your system by randomly turning things off, without understanding what you're doing, or how security works. Please don't."


DDOS attacks almost always come from different machines all around the world! So, It is better to use a service like Cloudflare or a Firewall, both of which check the Browsers before accessing your Server...

Thus, it is better to prevent from being DDOSed in this way, rather than checking which sources caused it!

I hope I helped you!


Blocking traffic on the server will generally not fix a DDoS problem; you need to block the traffic upstream. If the DDoS traffic looks the same as legitimate traffic, then you're going to need to out-scale the attack by moving your system into the cloud (or some other measure). If the DDoS traffic looks different (different port, specific source address(es)), you can ask your service provider to get them to block the traffic.

What does the traffic actually look like? Have you looked?

Do not block all UDP; that's not smart. DNS uses UDP.


If you are running a Linux-based server, you can help prevent DDOS attacks with iptables:

-I INPUT -p TCP -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT
-I INPUT -p udp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT

Add the above rules to /etc/iptables.up.rules


you can use the concept of bandwidth throttling and capping depends upon you, how you are going to manage.

Bandwidth throttling means you are going to restrict the server how much data it will accept. there is one project on google http://ultramegabit.com/file/details/-XskwK704PI this concept used by isp's to overcome from server crash or overloading

Capping has opposite meaning, in this you will use the bandwidth when available. These two methods only prevent server crash.

For tracing and preventing DDOS you have to check the server logs i.e if you are getting more web request then you check your apache log. From there you will get some clue but in this case false positive will be there.

Best way is harden your os.

  • 1
    Hardening your OS does not mitigate a sufficiently sized DDoS.
    – NULLZ
    May 13, 2013 at 5:52
  • I'm sorry, but you don't seem to understand what DDoS is. None of what you suggest would do anything to defend against or help prevent such events in the future. Detection is beyond the point tho, it's rather obvious when it's time you need to worry about being DDoS-ed and having a look into one's Apache logs certainly won't help determine which requests are from the attacker, and which aren't. That's the whole point of DDoS - it looks like normal requests, but in to the server unmanageable numbers.
    – TildalWave
    May 13, 2013 at 5:55
  • hardening os will remove the security flaws that is known to outside world. DDoS attack can be detected by using logs because you can see the behaviour of that ip means how much time they have requested but requires learning.
    – ifexploit
    May 13, 2013 at 6:17
  • 1
    DDoS has nothing to do with security flaws; it's just an unmanageable flood of traffic. Also, it's not just one IP - that first D stands for Distributed... May 13, 2013 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .