We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now. Yesterday, the server became unresponsive (it was definitely there though) for around an hour. Shortly after we received an e-mail saying that our server is involved in a netscan:

Mon Oct 8 03:30:24 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP 80

Mon Oct 8 02:57:16 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_2 80

Mon Oct 8 03:26:43 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_3 80

Mon Oct 8 03:26:52 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_3 80

Mon Oct 8 03:13:13 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_3 80

Mon Oct 8 03:13:15 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_4 80

Mon Oct 8 03:21:23 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_4 80


Mon Oct 8 02:45:11 2012 TCP MY_SERVER_IP_GOES_HERE 80 => SOME_OTHER_IP_1 1234

Mon Oct 8 03:19:43 2012 TCP MY_SERVER_IP_GOES_HERE 80 => SOME_OTHER_IP_2 1234

Mon Oct 8 03:24:00 2012 TCP MY_SERVER_IP_GOES_HERE 80 => SOME_OTHER_IP_3 1234

My first thought that we've been compromised, however after checking logs, histories, databases, etc. I see no indication of that. Obviously the attacker may have covered their tracks well, but I see no reason at this point to believe otherwise.

My question is, are there any attacks where an attack can bounce off our server to hit another server, thus slowing down our server but not actually compromising it? If so, what are they called so I can research them? So it would look something like:

  • Attacker sends a multitude of packets to my server.
  • My server receives packets on the ports specified (which seem to be 22 and 80). My server analyzes the packets and says "This packet is meant for SOME_IP on port 80. I'd better forward it on to them"
  • My server forwards the packets.

Any help would be greatly appreciated.

  • Why do you assume the server hasn't been compromised? I would start with the assumption that the server has indeed been compromised.
    – Sean W.
    Oct 8 '12 at 22:24
  • As I said, there's no way of knowing, but at this point it doesn't seem likely. That's why I want to know if any types of attacks exist like the one I listed above. If there are those types, I can look into them and hopefully find that that's what happened. If there aren't any (that are known), then I know to continue searching.
    – Chris
    Oct 8 '12 at 22:26
  • @SeanW. To quote: "My first thought (was) that we've been compromised, however after checking logs, histories, databases, etc. I see no indication of that". Emphasis mine.
    – Moses
    Oct 8 '12 at 22:30
  • Yeah, I missed that bit. Sorry.
    – Sean W.
    Oct 8 '12 at 22:32

Have a quick read of the Wikipedia article on reflection attacks: http://en.m.wikipedia.org/wiki/Denial-of-service_attack#section_2

Using Internet Protocol address spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.

It's a relatively easy way for an attacker to launch a large scale attack from many IP addresses against one target.

  • I think this is exactly it. I've looked through everything again and see absolutely nothing that points to a compromised system. My gut tells me it was a reflected attack. I'm going to look into how to stop these right now. Thanks for the tip!
    – Chris
    Oct 9 '12 at 3:20

It definitely sounds like a spoofed IP address DoS attack, not a compromised server (you can't assume that though!) as you have external traffic hitting your system, not originating from your system. The best way to handle this is depends on your hardware available, and is best done at your network's perimeter as it will keep processing load off your server entirely.

This type of DoS attack is characterized by a flood of syn packets from a single source address, so during an attack the best way to defeat it is to simply drop any packets from that source address. On a cisco router it would be applying an access list like this:

ip access-list extended perimeter_block 10 deny ip any

ip access-list extended perimeter_block 100 permit ip any any

then apply it to the external interface:

ip access-group perimeter_block in

then save the config. This will block any traffic destined for your server from that spoofed IP address. If you have a firewall instead of a router you'd want to have the same 2 lines as firewall rules to block any traffic from that IP.

That will take care of traffic during an attack and get your server back up and running, but you need a solution that will protect your server from the attacks in the first place. For that it's best to use TCP syn rate limiting. This can be done on some routers and firewalls, or on the server using IPtables. Again, I'd suggest implementing this on your perimeter network devices if you can rather than letting it get to your server. Here's how to rate limit on Cisco using CAR, and IPtables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.