My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (website, SSH, SMTP, etc...) except the port attacked.
The service that runs on that port is using 8-10% CPU and about 900 MB RAM (which is normal, even lower) DoS definition?
My provider has detected it as a DDoS attack and sent my server to the mitigation infrastructure.
I have tried to block all incoming traffic from that port using iptables allowing just my IP address with no success, the service was still unavailable (I tried to kill the process -9 and starting it again with all connections blocked).
iptables -A INPUT -p tcp --dport xxxx -s myip/32 -j ACCEPT
iptables -A INPUT -p udp --dport xxxx -s myip/32 -j ACCEPT
iptables -A INPUT -p tcp --dport xxxx -j DROP
iptables -A INPUT -p udp --dport xxxx -j DROP
The weird thing is if I open the service on another port, everything is fine. The server responds as if it wasn't being attacked, the same happens with all other applications.
tcpdump detects tons of UDP packets like:
No: 6610
Time: 3.517741
Source: 84.35.69.7
Destination: My server
Protocol: UDP
Length: 46
Info: 18926 -> xxxx Len=4
I'd like to know how do I diagnose this kind of attack since I am still new to this networking world or if I am missing doing something.
tcpdump
: one src address versus many. If you are interested on the method to perform such an attack analysis, just ask a new question about this.