HELP! server under attack
 

134.95.38.26 pppoe26.swhBachemerstr.Uni-Koeln.DE

This IP address is flooding my Apache server. Nobody can access the site.

How can I block this IP address from reaching my server???

:helpme

login as root and type:

shutdown -h now

Funkmaster is actually right. Just shutdown the server for a couple of minutes. Most of those attacks are automatic and stop once they get no response from the server. It'll have moved on once you get the server back up (in most cases)

I just got this from my tech guy.

You can try dropping the route to that machine...

/sbin/route add -host {IPADDRESS} -interface lo0

rm -r usr/local/apache :Graucho

... in your case, that´ll be:

<b>/sbin/route add -host 134.95.38.26 127.0.0.1 </b>

... unless you do

<b>/usr/local/apache/bin/apachectl stop</b>

after deleting apache, it won´t work.

the best defense is a good offense


take them down....you know where the I.P. is

ping -fs 50000 134.95.38.26

--- 134.95.38.26 ping statistics ---
50000 packets transmitted, 0 packets received, 100% packet loss

... DOH !!!

just shut it down.

[rootprompt]# iptables -A INPUT -s 134.95.38.26 -j DROP

Thank you guys.
I stopped the Apache for 2-3 minutes. And attack is over.

Funkmaster, yes I can't ping that IP anymore, but it was on some time ago.

I'll try /sbin/route command