Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.

The server is being ddosed since 8 months ago till today. I've tried to talk with the server provider but they couldn't help me.

When the server is under attack, the remote desktop is down, and so is the webserver and server console, and I need to talk with the provider to tell them to restart my server.

Could I add a program or something to trace the activity and to identify the type of attack (the source) then block it?

share|improve this question

5 Answers 5

If you are running a Linux-based server, you can help prevent DDOS attacks with iptables:

-I INPUT -p TCP -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT
-I INPUT -p udp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT

Add the above rules to /etc/iptables.up.rules

share|improve this answer

you can use the concept of bandwidth throttling and capping depends upon you, how you are going to manage.

Bandwidth throttling means you are going to restrict the server how much data it will accept. there is one project on google http://ultramegabit.com/file/details/-XskwK704PI this concept used by isp's to overcome from server crash or overloading

Capping has opposite meaning, in this you will use the bandwidth when available. These two methods only prevent server crash.

For tracing and preventing DDOS you have to check the server logs i.e if you are getting more web request then you check your apache log. From there you will get some clue but in this case false positive will be there.

Best way is harden your os.

share|improve this answer

Blocking traffic on the server will generally not fix a DDoS problem; you need to block the traffic upstream. If the DDoS traffic looks the same as legitimate traffic, then you're going to need to out-scale the attack by moving your system into the cloud (or some other measure). If the DDoS traffic looks different (different port, specific source address(es)), you can ask your service provider to get them to block the traffic.

What does the traffic actually look like? Have you looked?

Do not block all UDP; that's not smart. DNS uses UDP.

share|improve this answer

DDOS attacks almost always come from different machines all around the world! So, It is better to use a service like Cloudflare or a Firewall, both of which check the Browsers before accessing your Server...

Thus, it is better to prevent from being DDOSed in this way, rather than checking which sources caused it!

I hope I helped you!

share|improve this answer

Are you sure this is a real DDoS? Over an 8 month period you would think that the "attackers" would find something better to do. Did you implement an update in the game around that time that causes it to fail an authentication procedure or something similar?

you can disable UDP as per this answer, however note the answerer's warning

"I've NEVER encountered a situation where turning off UDP was a good idea. It seems like you're trying to secure your system by randomly turning things off, without understanding what you're doing, or how security works. Please don't."

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.11.21.2038\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Information Security Stack Exchange works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\""], "copyright__copyright__copyright": ["swer, however note the answerer's warning\n\n\"I've NEVER encountered a situation where turning off UDP was a good idea. It seems like you're trying to secure your system by randomly turning things off, without understanding what you're doing, or how security works. Please don't.\"\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}