DDoS attack

Discussion in 'Site & Server Administration' started by Namesniper, Apr 6, 2007.

  1. #1
    Hello,

    I see that a number of IPs send "post" commend to my index.php but i am trying to find out what exactly they are trying to post and into which form on that page.

    Can anyone please advice ?
     
    Namesniper, Apr 6, 2007 IP
  2. Estevan

    Estevan Peon

    Messages:
    120
    Likes Received:
    8
    Best Answers:
    1
    Trophy Points:
    0
    #2
    hello
    first this no are a DDoS attack !
    real DDoS attack put down big sites !

    well 2 options or kids ( using premade tools to find vuln applications ) or spammers try to make email injection !

    all have a lot spammers and kids !
     
    Estevan, Apr 6, 2007 IP
  3. Namesniper

    Namesniper Well-Known Member

    Messages:
    365
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    118
    #3
    This is indeed considered as DDoS,its setup a smart way and can kill any dual xeon based server in minutes
     
    Namesniper, Apr 6, 2007 IP
  4. rootbinbash

    rootbinbash Peon

    Messages:
    2,198
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    0
    #4
    maybe DOS but not DDOS
     
    rootbinbash, Apr 6, 2007 IP
  5. Snout

    Snout Peon

    Messages:
    238
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    0
    #5
    DDoS is a Distributed DoS. Since there is a number of IPs, it can be considered as DDoS. Usually DDoS hits site IP with junk packets, not using some http post requests.

    There might be some reasonable explanation (bad scripts or some broken cron job) or it could actually be some kind of abusive attack. Try banning the IPs (if the amount of addresses/ranges is not too high). Try banning the request or user agent pattern. Try contacting the hoster, if its a large and serious one, they could solve it for you by setting temporal filters.
     
    Snout, Apr 7, 2007 IP
  6. Estevan

    Estevan Peon

    Messages:
    120
    Likes Received:
    8
    Best Answers:
    1
    Trophy Points:
    0
    #6
    if posts requests put down a server , need sysadmin make a better config some sites have zillion of requests and work fine all time !
     
    Estevan, Apr 7, 2007 IP
  7. Namesniper

    Namesniper Well-Known Member

    Messages:
    365
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    118
    #7
    And some websites have 100 requests and turn down any server,forum websites for example
     
    Namesniper, Apr 8, 2007 IP
  8. Estevan

    Estevan Peon

    Messages:
    120
    Likes Received:
    8
    Best Answers:
    1
    Trophy Points:
    0
    #8
    look have many forms to prevent this mod evasive is one if have more to x requests ban the ip , sorry but get and posts requests are used only by kid and spammers if make a good config all are ok !

    the problem are the real attacks !
    lite kids and stupids spammers only use premade tools no have a brain , look in your logs all are the same requests and the same users agents !

    install mod evasive , mod security add good rules !
     
    Estevan, Apr 8, 2007 IP
  9. inworx

    inworx Peon

    Messages:
    4,860
    Likes Received:
    201
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Yes, it IS a DOS attack and not DDOS because if it was, then you would rather say here, my site is down.

    DDOS can birn ANY server down within minutes as someone one dial up can behave like user os 10 MBPS connection...

    Use mod_evasive by zdirski* or whatever, thats excellent. Works like a charm...
     
    inworx, Apr 10, 2007 IP
  10. Namesniper

    Namesniper Well-Known Member

    Messages:
    365
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    118
    #10
    1)DDoS wont burn your server,no matter hwo big the attack is at some point your server will go down and thats it,it will be unresponsive be it 100+ or 1000+ mbps,anything above 10 mbps will get it down easy

    2)I have mod_evasive installed but its not a good diea to leave it enabled forever,its banning googlebat and similat legit SE bots,if you tune it to dospagecount 100+ to not ban legit bots then it will not ban also bad bots,it will help but not an ideal solution for httpd low bandwidth attacks
     
    Namesniper, Apr 10, 2007 IP