Arch Linux

Stythys

Member

From: SF Bay Area

Registered: 2008-05-18

Posts: 878

Website

DDoS

Hey guys. Well, earlier...someone decided to start a DDoS on my server. Yeah, I know, great, huh? Anyways...after talking a bit on IRC and contacting my server hosts, the only thing we could do was basically shut off the server from any external traffic. Can anyone here offer any help? I really don't want my server to be just suddenly off...forever . Whenever we switch it back on I assume he can just start up again, if it won't start up automatically.

---

[home page] -- [code / configs]

"Once you go Arch, you must remain there for life or else Allan will track you down and break you."
-- Bregol

Peasantoid

Member

Registered: 2009-04-26

Posts: 928

Website

Re: DDoS

You sure it's a DDoS and not just a regular DoS? If it's the latter, you can just blacklist the culprit IPs, using whatever method is appropriate for your server software.

Stythys

Member

From: SF Bay Area

Registered: 2008-05-18

Posts: 878

Website

Re: DDoS

yes, it's a DDoS

---

[home page] -- [code / configs]

"Once you go Arch, you must remain there for life or else Allan will track you down and break you."
-- Bregol

pizmooz

Member

Registered: 2009-01-11

Posts: 21

Re: DDoS

How about collect IPs from the server logs.  Then see if the IPs correspond to a particular geographic region.  Maybe all the requests are from a few subnets.