Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ddos]

Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

2
votes
4answers
134 views

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood attack?

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood (SYN Reflection) attack?
1
vote
1answer
55 views

How does IP traceback works? [closed]

In part prompted by the difficulties in determining the true origins of DDOS attacks featuring spoofed IP addresses, researchers have attempted to develop the concept of IP traceback: determining ...
0
votes
0answers
36 views

Protect website from multiple requests [on hold]

I have a signup api , someone trying to make multiple attempts through different ips what could be the best possible solution. i read and found waf can be used but it is costly . could ssl ...
1
vote
1answer
54 views

Blockchain + shared unused bandwidth as the proxy front = ddos mitigated?

Pentesting the new webapp that we have developed before having an external source have a go at it and give us a risk assessment. Now we have come to the portion right at the end; DDOS. For the most ...
0
votes
1answer
61 views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
0
votes
2answers
98 views

Please help diagnose multiple incoming packets

We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information: All the packet size is same (i.e. 40 bytes) All ...
0
votes
2answers
135 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
7
votes
1answer
211 views

Do major ISPs still ignore IP spoofing?

I was reading this question: Why don't ISPs filter on source address to prevent spoofing? and based on those answers, ISPs ignore it because of the overhead of checking for spoofing. But that ...
1
vote
1answer
44 views

How link flooding DDoS attack remain undetected?

I read some explains or paper about link flooding DDoS attack, which is new relatively. For example "employs legitimate, low-density flows to flood a group of selected links. Therefore, these ...
1
vote
1answer
113 views

Nginx: mod-security rule for http slow DoS attack

The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only. Is there a rule for Nginx?
3
votes
1answer
109 views

Firewall Showing 1,000's Of Strange GET Parameters Being Sent To Login Page?

So I woke up today, and checked my Firewall Events on CloudFlare for my website like I do normally. Most of the time I'll just see thousands of failed SQL injection attempts, but this morning I was ...
3
votes
3answers
362 views

Suspicious “100% guaranteed” web hosting security package

Notes: I have very limited knowledge and experience in this field. My boss does not want to spend a penny more that what we already paid for. The website has a form that sends a message to our email ...
-1
votes
1answer
100 views

Why the DDoS attacker need many zombie machine for attack? [duplicate]

Why the DDoS attacker need many zombie machine for attack? if attacker has one machine for generate enough attack traffic for its business(DoS), does it still need many zombie machine(DDoS)? what's ...
4
votes
3answers
2k views

Threshold for DDOS Attack

I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
2
votes
2answers
139 views

Is it possible to defend against a backscatter attack?

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender. The usual best practices are ...
1
vote
0answers
69 views

Will More vCPU's and RAM Help Protect Against Some Smaller Scale DDoS Attacks?

Obviously having more vCPU's (virtual CPU's) and more RAM by them self won't be able to alone help stop and/or prevent a DDoS attack, but let's say after a DDoS attack is finished and/or slowing down ...
2
votes
1answer
285 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
0
votes
1answer
103 views

Can I assume that an empty user agent will always be a robot?

I want to prevent robots flooding my website and I'm thinking about a ban in these cases... Can I assume that an empty user agent will always be a robot?
1
vote
3answers
241 views

How to detect when one or more devices in my local network have become DDOS attack nodes?

I have a home network, big family, with around 20 devices on it at any given time. It seems like every year or so, some device gets a virus or a security flaw is revealed, and the device starts ...
6
votes
4answers
529 views

Most reduced types of DoS attacks

As I understand it, there are generally only two common types of Denial of Service attacks in regards to the OSI model: Network-Layer-DoS (NLDoS) on layers 3, 2 or 1. Application-Layer-DoS (ALDoS) on ...
-4
votes
1answer
100 views

TCP protocol Denial-of-service attack [closed]

There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol ...
2
votes
2answers
120 views

How do you detect a Memcached DDoS attack on your server?

In terms of early detection, how could a sysadmin detect that a Memcached DDoS attack took place?
-2
votes
1answer
80 views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
3
votes
3answers
174 views

Is a DoS attack possible on a single home connection when the ISP uses NAT?

Today almost all ISPs use a NAT system to assign more people the same IP (at least where I am), probably because the IPv4 addresses are ending and they want to save money. Is it possible to make a DoS ...
-2
votes
2answers
225 views

Why is DDOS is one of the most common Cyber-Attack? [closed]

Based on some articles and some research DDOS is one of the most common cyber-attack. There are tonnes of articles out there about the DDOS subject, including describing, mitigating, the question "...
2
votes
1answer
304 views

Difference between DNS flood attack and DNS amplifier attack [duplicate]

I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them? It ...
0
votes
1answer
216 views

What Are the Algorithm and techniques of IP Traceback?

In most of the cases the cyber attacks such as a DDoS attack or other kinds, it is sometimes hard/impossible to identify the real source IP addresses. This is because when you review the logs and ...
0
votes
1answer
51 views

Why does Spamhaus' CBL blocklist return records for 1.1.1.1 and 8.8.8.8?

I'm looking up ips with the following code import dns.resolver resolver = dns.resolver.Resolver() resolver.timeout = 0.10 resolver.lifetime = 0.10 resolver.nameservers = ['127.0.0.53'] searchIp = '8....
4
votes
2answers
327 views

Use mining to prevent DDOS attacks on websocket: Is this a viable solution?

I'm thinking whether the following way is a good way to completely and totally prevent ddos on my server. My idea is to use the same mechanism of cryptocurrency mining (bitcoin, with sha256 or any ...
-2
votes
1answer
116 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
1
vote
2answers
114 views

Are HTTP calls from hundreds of ips in the same subnet malicious?

I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources. I found by running a match in redis (where all requests from the last 24hrs ...
6
votes
1answer
139 views

How SSL/TLS handshake happens when we use Cloudflare Service?

I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare. Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
2
votes
2answers
106 views

How does LBaaS / DBaaS or “auto-scaling” help protect from DoS?

I ask this question as a follow up to this question in which I asked how I could protect from the simplest types of DoS attacks (say single-machine / up to 5 machines network level DoS attack) without ...
1
vote
2answers
147 views

packets characteristics (src,dst ports) of a DDos amplification attacks

In a DDoS amplification attack, say NTP flooding, an attacker uses a botnet network in order to query multiple NTP servers on port 123, spoofing the source address using the address of the victim/...
-1
votes
2answers
277 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
1
vote
2answers
57 views

Is DDoS a specific type of ALDoS

In a very broad terminology: I understand Application Layer Denial of Service (ALDoS) to be a 1 machine on 1 machine attack. I understand Distributed Denial of Service DDoS (DDoS) to be a 2 or more ...
0
votes
4answers
1k views

Does google's reCAPTCHA mitigate DDoS attacks?

I was reading this post from half a decade ago about the pros and cons of using captcha during a DDoS attack (How does CAPTCHA mitigate DDoS attacks?) At that time there seems to be basically 2 ...
2
votes
1answer
193 views

DNS flood vs DNS Amplification attack: How is one considered a network/transport layer attack and the other a application layer attack?

I am reading a survey on DDoS attacks and they describe how these attacks can be classified by either Network/Transport level attacks and Application level attacks. In their examples, they classify ...
3
votes
1answer
157 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
0
votes
0answers
475 views

How to determine DoS protection rates for firewall

I am looking to enable my Firewall's DoS protection, and when searching for values to put in the rate fields, am finding that the answer is usually "it depends". While there is almost always room for ...
4
votes
2answers
356 views

Shouldn't netstat show connections from many different IP addresses during a DDoS, unlike this example?

I just read this article from loggly (https://www.loggly.com/blog/how-to-detect-and-analyze-ddos-attacks-using-log-analysis/), and it got me wondering. The author states that under a DDoS attack, ...
9
votes
1answer
2k views

Difference between Amplification and Reflection Attack?

Reflection Attack: Reflection attacks are attacks that use the same protocol in both directions. The attacker spoofs the victim’s IP address and sends a request for information via UDP to servers ...
0
votes
0answers
42 views

Webhook server protection

use-case A user sends a file to us, we process that file and sending callback request to his server that his file is uploaded to our servers. Now what I'm concerned about is the server that sending ...
5
votes
3answers
644 views

Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?

I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
1
vote
1answer
197 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
3
votes
1answer
185 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
0
votes
1answer
100 views

Random accounts being created, why?

I have a small business that provides an online service, like a CRM service for businesses. Over the last few weeks, I've had 20 - 30 random accounts created. (this is unusual as I might get one or 2 ...
-2
votes
1answer
137 views

Site receives high amount of random requests

[Question moved from stackoverflow] Since about two weeks, a site is receiving an increased amount of requests for nonexisting pages. The calls are for existing pages but with a prefix of 5 random ...
5
votes
2answers
906 views

Is SYN DDoS the only type of TCP DDoS?

I have been reading up on different types of DDoS attacks recently and came upon DDoS distribution by type in 2017, by Kaspersky Labs. They list 5 different DDoS types: SYN, TCP, UDP, HTTP, ICMP In ...
0
votes
1answer
160 views

Can back up servers be used to defend against DDoS?

Would having back up servers which kick in instantly when the primary server goes down kill a DDoS attack or just delay it? How many networks, distributed, would a midsize company need to withstand a ...