1

My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (website, SSH, SMTP, etc...) except the port attacked.

The service that runs on that port is using 8-10% CPU and about 900 MB RAM (which is normal, even lower) DoS definition?

My provider has detected it as a DDoS attack and sent my server to the mitigation infrastructure.

I have tried to block all incoming traffic from that port using iptables allowing just my IP address with no success, the service was still unavailable (I tried to kill the process -9 and starting it again with all connections blocked).

iptables -A INPUT -p tcp --dport xxxx -s myip/32 -j ACCEPT
iptables -A INPUT -p udp --dport xxxx -s myip/32 -j ACCEPT
iptables -A INPUT -p tcp --dport xxxx -j DROP
iptables -A INPUT -p udp --dport xxxx -j DROP

The weird thing is if I open the service on another port, everything is fine. The server responds as if it wasn't being attacked, the same happens with all other applications.

tcpdump detects tons of UDP packets like:

No: 6610
Time: 3.517741
Source: 84.35.69.7
Destination: My server
Protocol: UDP
Length: 46
Info: 18926 -> xxxx Len=4

I'd like to know how do I diagnose this kind of attack since I am still new to this networking world or if I am missing doing something.

Improve this question
7
  • Simply, you will see traffic coming from many, many sources rather than one or a few.
    – user173641
    May 9, 2021 at 15:56
  • 2
    I'm not sure how differentiating between the two things will help you restore service. You have a troubleshooting issue that may or may not be related to DoS and DDoS.
    – schroeder ♦
    May 9, 2021 at 16:06
  • 1
    Agree with @schroeder. Does it matter whether you have a DoS attack or a DDoS attack? All that matters is that you are having issues that need to be fixed. That distinction may make a difference in mitigation strategies, but it doesn't sound like it practically matters here.
    – Conor Mancone
    May 9, 2021 at 18:11
  • As far as I know the difference between them is that DDoS usually cost money (needs a botnet ?) while DoS can be done from a cheap network/computer all day long. There is little we can do if we are being attacked from a botnet and will be a waste of time trying to add some rules to stop the attack or checking vulnerabilities in the software, we would better get an expensive anti DDoS mitigation infrastructure. I think one can save resources and time by just detecting which kind of attack is being done to the server
    – Naitoreven
    May 10, 2021 at 18:34
  • The key difference between a DOS and a DDOS is the "distributed" nature of the last one. A DDOS is using a network of remotely controlled attack PCs. You can diagnose this at first glance with a tcpdump: one src address versus many. If you are interested on the method to perform such an attack analysis, just ask a new question about this.
    – dan
    May 11, 2021 at 11:10

1 Answer 1

Reset to default
1

The main difference between a DoS and DDoS is that a DDoS (distributed) requires multiple hosts to flood one or multiple target servers, in other words, the volume of a DDoS is quite heavier. In your case, if your server can provide other services other than the targeted port and is taking few physical resources, chances are you are currently victim of a DoS, which means one specific computer has scanned an open port and is trying to saturate it at the moment (it could be for example a brute-force attack trying multiple combinaisons of credentials onto a service in order to login or a SYN flood attack, there is a wide choice of possibilities). Also, if you were involved in a DDoS attack, it would be probable that the entire server would not be able to provide any kind of service at all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .