What can I do now to stop botnet?

Discussion in 'Site & Server Administration' started by henry_nguyen, Jul 19, 2009.

  1. #1
    Hi all,

    what should I do now if my server is getting attack from BotNet?

    can i point my domain to other website domains?

    which ip should I point to to stop botnet? its been over 2 weeks now.

    please help

    thnks
     
    henry_nguyen, Jul 19, 2009 IP
  2. svrhost

    svrhost Peon

    Messages:
    127
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Contact me, I can help you stop these easily
    Thanks
     
    svrhost, Jul 20, 2009 IP
  3. ŦʂĞɧ ųŞøƝ

    ŦʂĞɧ ųŞøƝ Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    You cannot "Stop" a ddos/botnet attack only divurt or filter it away from you, lol! If anyone tells you that they can stop a ddos/botnet attack there lieing, However if you have the server's or the filtering/firewalls to filter the ddos attack then its just a matter as to what extent your filters/firewalls can hold.... If you have any questions about a botnet/ddosing please come to me first im in college for this i understand it clearly and will help with what i can. -iLLuSioN
     
    ŦʂĞɧ ųŞøƝ, Sep 12, 2010 IP
  4. st1905

    st1905 Well-Known Member

    Messages:
    573
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    135
    #4
    First, lets find out how many attacks we are getting, to do this execute this command at bash

    netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
    Code (markup):
    This will list the ips that have so many connections to the server.

    Now lets null-route those ips with iptables

    route add "ipaddress here" reject
    Code (markup):
    Do not include " at the command.
     
    st1905, Sep 12, 2010 IP