DDOS defense help

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • AnonymousGuy
    Registered User
    • Dec 2003
    • 3

    #1

    DDOS defense help

    I can't say who I am, but I'm under a DDOS attack, and I'm looking for some suggestions from some of you guys who've been through it before. Any tools or techniques? I must be doing well if somebody wants to try to take me out...
  • TheSaint
    Confirmed User
    • Jun 2003
    • 991

    #2
    I don't think there is a cookie cutter answer. It depends on how sophisticated the attack is.

    Your isp might help (unless you have Rackshack, they just turn you off. )

    Sometimes you can just move to another server, as the dummies that launched it hardwired the ip address. Sometimes they can follow you.

    Sometimes the attack is following a pattern that can be filtered in iptables or in routers.

    You need a network expert.
    I have no signature

    Comment

    • JamesK
      hi
      • Jun 2002
      • 16731

      #3
      pay the hacker to go away.
      M3Server - NATS Hosting

      Comment

      • -=HOAX=-
        Confirmed User
        • Dec 2001
        • 4365

        #4
        not trying to plug a host shamelessly, or make light of your troubles...but jupiterhosting flawlessly handled one of the worst ddos attacks this industry has seen in recent months. If you're not a techy...you need a host that can worry about that type of shit for you.
        Insert Value Here.

        Comment

        • MediumPimpin
          Confirmed User
          • Apr 2003
          • 1488

          #5
          Originally posted by -=HOAX=-
          not trying to plug a host shamelessly, or make light of your troubles...but jupiterhosting flawlessly handled one of the worst ddos attacks this industry has seen in recent months. If you're not a techy...you need a host that can worry about that type of shit for you.
          I had the same problem, had to move a server to Jupiter just to get a DDOS attack to stop, give Ray a call.
          nats.mediumpimpin.com

          Comment

          • Hen
            Confirmed User
            • Dec 2001
            • 113

            #6
            Contact one of our network engineers, ICQ# 6857074, he'll give you some good advice.

            Comment

            • gin
              Confirmed User
              • Sep 2003
              • 672

              #7
              you sure it's a ddos? the attacks on my sites i thought were ddos's but they were actually a syn type attack to overload the computer

              Comment

              • posh rat in hell
                Confirmed User
                • May 2002
                • 403

                #8
                Originally posted by gin
                you sure it's a ddos? the attacks on my sites i thought were ddos's but they were actually a syn type attack to overload the computer
                SYN floods can be DDoS's too ;)

                Comment

                • AnonymousGuy
                  Registered User
                  • Dec 2003
                  • 3

                  #9
                  Well, as always, moving to a new host is better said than done. MCI is the upstream provider, and they're looking into it. But of course, they're clueless. All they can say is "Yup, it's coming from multiple machines". I was hoping to be able to... take care of the problem myself.

                  Comment

                  • gin
                    Confirmed User
                    • Sep 2003
                    • 672

                    #10
                    Originally posted by AnonymousGuy
                    Well, as always, moving to a new host is better said than done. MCI is the upstream provider, and they're looking into it. But of course, they're clueless. All they can say is "Yup, it's coming from multiple machines". I was hoping to be able to... take care of the problem myself.
                    heh don't wait for the data center to do something.. took like 5 days before the one i was at did anything.. all they kept saying was "oh let me check into it" and would call me back with "yup your server is being attacked" no help at all

                    Comment

                    • Veterans Day
                      Confirmed User
                      • Jul 2003
                      • 8403

                      #11
                      Originally posted by Hen
                      Contact one of our network engineers, ICQ# 6857074, he'll give you some good advice.

                      good fuckin people here
                      Build a Massive Traffic Network, Hands FREE, Totally Automated

                      Comment

                      • icedemon
                        Confirmed User
                        • Jun 2003
                        • 1022

                        #12
                        http://staff.washington.edu/dittrich/misc/ddos/

                        How are they attacking you. Like is it just one port that is getting hammered or a SYN attack or what? Some DDOS attacks are easier to stop than others. But there might be someone here that can help you out if we had more info on how your getting attacked.
                        Clips4Sale.com

                        Comment

                        • elaborate
                          Registered User
                          • Oct 2003
                          • 151

                          #13
                          contact me on ICQ, i'll hunt them down for ya

                          ICQ: 251911362

                          Comment

                          • Phoenix66
                            Confirmed User
                            • Oct 2002
                            • 823

                            #14
                            Redirect DDOS requests to microsoft.com they will take care of this in couple of hours LOL

                            Though it's not possibe with some types off attacks.
                            Adult Niche Traffic Exchange

                            Comment

                            • AnonymousGuy
                              Registered User
                              • Dec 2003
                              • 3

                              #15
                              Thanks for the help, everybody, but my admin is going to give it a shot first. He wants to try tracking down these little bastards by himself. So, I'll give him a chance to sort it out himself, assuming that he can take care of it quickly. If he doesn't, I'll take up a few of you on your suggestions. Thanks very much.

                              Comment

                              Working...