I wrote about ddos attack in one of my post of DOS ATTACK . It can be done by many ways on a server. Here i am going to write the method by which you can check server under dos attack.
A quick and useful command for checking if a server is under ddos:
netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
This command will show the list of the IPs taking the most amounts of connections to this server. It is important to remember that ddos is becoming more sophisticated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.
A quick and useful command for checking if a server is under ddos:
netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
This command will show the list of the IPs taking the most amounts of connections to this server. It is important to remember that ddos is becoming more sophisticated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.
Another very important thing to look at is how many active connections your server is currently processing.
netstat -n | grep :80 |wc -l
netstat -n | grep :80 | grep SYN |wc -I
The first command will show the number of active connections that are open to your server. Many of the attacks typically seen work by starting a connection to the server and then notsending any reply making the server wait for it to time out. The number of active connections from the first command is going to vary widely but if you are much above 500 you are probably having problems. If the second command is over 100 you are having trouble with a syn attack.
To Block a certain IP address that on server .Please use following commands
route add ipaddress reject
for example route add 192.168.0.168 reject
route -n |grep IPaddress
OR
use follwoing command to block a ip with iptables on server
iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT
service iptables restart
service iptables save
Then KILL all httpd connection and restarted httpd service by using following command
killall -KILL httpd
service httpd startssl
These are the simple steps you have to follow when attack is going on. Obviously you have to use your presence of mind while working on it. You will find many ways to solve this issue.
