Hit By DDoS Attack -- Assistance Required

[Knucklehead00]

Hello all.

Today has been a trying day. After talking with my host for nearly 2 hours, I come to find that they do not support DDoS troubleshooting.

The furthest I have been able to get on my own is figuring out the host IP that is doing the DDoS. The problem is that I cannot figure out how to block it.

I have tried "iptables -I INPUT -s <the_IP> -j DROP" and that has not worked. I have restarted, stopped, and started Apache quite a lot. I have killed all processes many times over with "killall httpd".

All of the requests are coming in as apache httpd requests.

Any help would be greatly appreciated. My site has been down all day and people have been ticked to say the least.

[maximillianos]

If the attack is coming from a single IP then you are in pretty good shape.

Do you have APF installed? If so, you can do the following command:

apf -d the_ip

That's it!

If not, you could also do a programming change to check the IP and block it from running any of your pages. Perhaps in a header script?

[Knucklehead00]

Actually, I have no idea what is going on. I know that it is a DDoS of some type, but I have no idea how to pinpoint the source. I have searched all over the place with no luck.

If anyone knows how to source the root of the issue, it would be greatly appreciated.

The only command I have found to give me any kind of result back is --

netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n

Running that I find no IPs that have more than 6 connections. So, it must be coming from multiple IPs. If I do the "top" command, I find that my database is taking up about 50% or more of my CPU resource and then all of the httpd requests are taking up the rest.

I am running the newest version of Cent OS. I have contacted my host but apparently this kind of thing is outside their realm of support. Useless host.

Going to be switching as soon as I can access my FTP and database again.