Checking with ddos attack on server
A quick and useful command for checking if a server is under ddos is:
netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
This will list the IPs taking the most amounts of connections to a server. It is vital t to remember that the ddos is becoming more and more planned and sophisticated and hackers are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.
Another very important thing to look at is how many active connections your server is currently processing.
netstat -n | grep :80 |wc -l
netstat -n | grep :80 | grep SYN |wc -l
The first command will reflect the number of active connections which are open to your server. Most of the attacks generally seen work by starting a connection to the server and then not sending any reply making the server wait for longer. The number of active connections from the first command is going to vary in large amount but if you are much above 500 you are probably having problems. If the second command is over 100 you are having trouble with a syn attack.
To Block a certain IP address that on server .Please use following commands
—————–command——————————
route add ipaddress reject
for example route add 192.168.0.168 reject
You can check whether given IP is blocked on server by using following command
route -n |grep IPaddress
—————–command——————————
OR
use follwoing command to block a ip with iptables on server
—————–command——————————
iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT
service iptables restart
service iptables save
—————–command——————————
Then KILL all httpd connection and restarted httpd service by using following command
killall -KILL httpd
service httpd startssl
