Good Morning.
i have 1 question no more because i got many ddos attack and my load is 95++
what is the best program to stop DDOS Attack ???

Thanks
Abdelrahman

turn off the server .

0 members found this post helpful.

and then?

i get ddos attack from 5 days
i had ban alot of them
and load become 1
but they are back again so i wana stop them

Thanks

there is not much that can be done

is "fail2ban" installed and configured in Apache ?
http://www.fail2ban.org/wiki/index.php/HOWTOs

or have you blocked the ip's ?

what have you done ?

are you sure it is a "Distributed Denial of service "
and not a misconfiguration server just tiring to access

i once had "The University of Chicago" try to dl my ENTIRE site( html,php,ssc's ,png's ,jpg's everything) over and over and over .To the tune of 4 to 6 gig per day .

Eng_Designer, please spell out your words and avoid using 'texting' slang, short lines, and abbreviations because it makes your question very hard to read.

As far as your concerns about a DDOS attack, the best thing you can do is contact your ISP. If you really are facing a DDOS, the help of your ISP will be required to stop it. The chances that you are actually getting such an attack are very small, unless you have done something to anger the wrong group of people. This is not to say that you aren't have a problem with rogue connections, just that it isn't likely to be a true DDOS scenario.

Rather than speculate on what may, or may not be happening, would you please post some examples of the troublesome log entries. Also describe exactly what you are trying to do and what type of service / server you are running. Also look at your logs for signs of a problem other than connections as this can cause a very high system load.

3 members found this post helpful.

i solve it
thanks alot

---------- Post added 06-01-11 at 10:58 PM ----------

i'm sorry for my bad language but i was write fast ,
anyway, i solve it
thanks alot

0 members found this post helpful.

How did you solve it?

Are you actually running Linux?

Since no-one has mentioned this, please don't put "urgent" in your thread titles. This is a volunteer site and no threads are any more urgent than any other.

Also, "alot" is incorrect - it should be two words (see the link in my signature).

i make a bash script that's block's ip's make syn attack

so?
we will forget problem and debate what should i write alot or a lot?
thanks for reply and your solve !!

Huh? The "DDoS" you were referring to was a SYN flood? How did you conclude it was DDoS? I mean, a SYN flood can be done from a single IP-spoofing host (no DDoS necessary). What does your script look like? Why didn't you just enable SYN cookies?

1 members found this post helpful.

and SYN attack also not only DDoS


#!/bin/bash

netstat -na | grep -i SYN_RECV |cut -d: -f2 |awk '{print $2}' > /tmp/ip
for i in `cat /tmp/ip`
do
iptables -v -A INPUT -s ${i} -j DROP
iptables -v -D INPUT -s ${i} -j DROP
iptables -v -A OUTPUT -d ${i} -j DROP
iptables -v -I INPUT -s ${i} -j DROP
done
service iptables save

i forget check SYN cookies, i will check it

So basically you're using netstat to look for half-open connections, then using iptables to filter packets from the relevant source addresses? What you've done is essentially created a giant denial-of-service vulnerability. Now all a bad guy has to do is spoof a packet with the source IP of any host he wishes to block to/from your server (which may include critical things such as security update package repositories). Not to mention that since in most SYN floods the spoofed IPs are random, these iptables rules are potentially useless. So yeah, use SYN cookies instead (it's what they're designed for). Getting back to the DDoS (separate issue): How did you solve that? Did your ISP jump in? You never even showed us or described what it looked like, AFAICT.

3 members found this post helpful.

There is a compelling reason to use tools like "Shorewall" to manage your iptables entries. (P.S. it's free, FOSS.)

When you simply try to "roll your own" commands, you're very likely to make some mistake ... even to create some vulnerability ... just because you really didn't know what you are doing. Whereas the authors of Shorewall have dealt with the same problems very deeply for a long time and have developed software to do the right thing.