My server has been repeatedly attacked in the last few days. Here's the observations:

  1. The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and holds for 10 minutes.
  2. I've got fail2ban turned on, and ICMP echo off. I've got port 80/443, 22 open, and this is an Ubuntu 12 server. The log shows that the incoming traffic is not recorded by nginx or sshd, which means no successful connection to these port were attempted.
  3. I'm pretty positive that I'm not suffering from any kind of data loss, and the server is not hacked.

I understand that this is some form of DDOS attack. I'm wondering if there are any system logs that I can review to find the source of the traffic and the type of attack?

closed as too broad by Adi, NULLZ, TildalWave, Lucas Kauffman, Ayrx Aug 18 '13 at 15:21

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The best way to know definitively is to run tcpdump (or similar) for the next few days, then view the resulting pcaps and see what the traffic looks like. – Anorov Aug 19 '13 at 19:49

Depending on the type of attack you can either do this with ip tables ( if you are running Linux) or request your ISP to see where the traffic is coming from. The latter is actually the best option as the traffic might contain spoofed IP addresses. Your ISP should be able to locate where the traffic is coming from ( roughly) and see if they can block it using BGP.

You can't do anything against a DDoS locally, once the traffic reaches you it's already way too late.

  • Well, I am running Ubuntu server with iptables, ufw actually. But it appears that the traffic goes through the firewall anyway. And without knowing the type of the traffic, I got no options to strengthen the iptables rules. Is there really nothing I can do locally? Not even make the packets drop between the datacenter switch and my server? – He Shiming Aug 18 '13 at 11:04
  • The traffic doesn't go through the firewall, even if you drop everything except ports where you run services on. The problem is the traffic reaches you, so your machine receives the traffic and needs to decide what to do with it depending on the rules defined for your firewall. This means you are processing the requests. That's why you can't stop a DDoS with a local firewall and that's why you need to request your ISP to drop the traffic before it reaches you. There are other options like cloudfare which can assist as well. – Lucas Kauffman Aug 18 '13 at 13:49
  • Thanks for the explanation. I'm clear on this now. But is there a method that could at least provide a log of it so that I don't have to guess? – He Shiming Aug 18 '13 at 14:51
  • Iptables can log dropped and rejected packages (google it). Do note that if you get 300 Mbit/s this might get a bit hairy as it can full up your disk instantly. – Lucas Kauffman Aug 18 '13 at 14:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.