DDOS – Distributed Denial of service attack
DDOS or DOS (Denial of service ) is an attack in the server , where the server resources become unavailable to the users. It can be typically defined as the loss of network connectivity and services by consuming the bandwidth and resources of the victim network or overloading the victim server. Attempts to “flood” a network with bogus packets , there by preventing legitimate traffic is the common form of attack.
Beyond this, there are 2 types of attacks:
1.Smurf attack :- ICMP requests are sent to the broadcast address of misconfigured network with a faked or spoofed source IP address , set to one of the target.
2.Syn flood attack :- Bogus SYN requests to a service ( eg: HTTP) cause the server to be overloaded.
Command to check whether the server is under tcp/udp denial of service attack
# netstat -ntu | grep tcp/udp | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n|wc –l
If the output of the command is 2000 or 3000 it is sure that the server is under DDOS attack.
Also:
netstat –alpn | grep :80 | awk ‘{print $4}’ |awk –F : ‘{print $ (NF -1) }’ | sort | uniq –c | sort -n
Command to check the IP addresses currently connected to the server
# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort –n
When we get a lot of httpd process by running the command top –d2 , then we have to check whether it is a DOS attack and to realize whether the server is flooded with SYN packets.
Command to check the SYN packet flood
# netstat -nap | grep SYN | wc –l
If the output of the command is an abnormal ( large, say 2000 or 30000) number, then it is sure that the server is under attack.
Command to check ,from which IP Addresses the packet arise
# netstat –nap | less
If the attack is coming from a particular IP address , we can block the IP address in the server using the following command:
Command used to block an IP address in the server
# route add <IP address> reject
Command used to check whether the IP address is blocked
# route -n | grep <IP address>
We can also use iptables to block an IP address in the server
# iptables –A INPUT 1 –s <IPADDRESS> –j DROP/REJECT
# service iptables save
# service iptables restart
Then kill all httpd connection and then restart the service
# killall –KILL httpd
# service httpd startssl
Checking DDOS in VPS hardware node using tcpdump
# tcpdump -c 100 -i eth0
