I have a ubuntu server with nginx. I am getting ddos on port 80. I ran the following command to see the current IPs:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

It shows thousands of IPs are on server. My server is also down BTW. I do not know how to block such kind of attacks. Attached is the screenshot of the tcpdump. Please PM me if you want to have a look at the complete tcpdump.

http://158.69.217.25/ddos.jpg

All connecting to port 80?

I don't know whether or not this will help, but I offer it anyway. I did a short gig with a hosting service. It sometimes happened that a website on a shared hosting machine would get DDoS'd, which would bring down the entire server, as they all shared the ip address of the server.

The hosting service's strategy to "mitigate" (their term) the attack was to move the other websites off to a different server to get them out of the line of fire.

A web search for "mitigate ddos" will turn up lots of articles; perhaps you can find something there.

What does OVH say about it?

Hi all,
Thanks for you reply. I captured the packets and found it's a Wordpress pingback attack. There are thousands of IPs involved in the attack on only port 80. I used following rule to block this attack:

iptables -A INPUT -p tcp -m recent --update --seconds 600 --name PINGBACK --rsource -j DROP
iptables -A INPUT -p tcp -m tcp --dport 80 -m string --string "WordPress/" --algo kmp -m recent --set --name PINGBACK --rsource

This rule is from this site. It works all fine. However, the IPs keep coming back and my system tried to keep blocking the packets. I want to log the list of all these IPs which contain "WordPress" in the header. Is it possible to do it?

You should be able to use grep to extract the list of hits containing the string "WordPress" in them and save them to a file. For example

"cat" reads the file, "grep Wordpress" extracts lines containing that string (note that it is case sensitive), and "> [somefile]" sends the output to a file of your choosing. You can then examine the file in a text editor.

See man pipe, man grep, and man pipe for more.

Thanks for the reply. I am aware of these commands. However, I couldn't find the log file where it is keeping the track of all this. Also I find out loads of following messages in dmesg:

net_ratelimit: 346 callbacks suppressed
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet

I would guess that, as you are using nginx, they are somewhere in the nginx logs.

I've not used nginx, but I have used Apache, and Apache logs everything. I assume that nginx does the same, but I fear I cannot suggest where you should look.

/var/log/nginx/{error,access}.log, of course