Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Site being DDOSed

Options
  • 26-12-2012 2:36pm
    #1
    Media999
    Registered Users Posts: 1,695 ✭✭✭


    Bit of a strange one here. Usually i can just block an ip from netstat and problem solved but this time all that shows up is
    tcp        0      0 localhost.localdomain:http  msnbot-65-55-24-236.s:53841 TIME_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:56733 CLOSE_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:53713 CLOSE_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:46631 CLOSE_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:49695 CLOSE_WAIT

    iptables blocking wont work. Any solution for this? Some fool from Latvia is repeatedly at this. No idea why it benefits them in any way.


Comments

  • Options
    #2
    BrokenArrows
    Registered Users Posts: 7,501 ✭✭✭BrokenArrows


    The host might be hst-164-224.duomenucentras.lt

    duomenucentras.it supplies servers for rent.


  • Options
    #3
    Colonel Panic
    Registered Users Posts: 2,022 ✭✭✭Colonel Panic


    What's showing up in your web server's logs? How about using Fail2Ban to monitor your server logs and generate iptables rules?


  • Options
    #4
    Media999
    Registered Users Posts: 1,695 ✭✭✭Media999


    Cheers for the help folks. I just went out and left it. Just back and got this command off my host
    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

    Really nice way of finding whos attacking. never had to use it before as an ip would just show up. Pretty much have all bases covered with that as it only happens once every couple of months and im able to stop it fairly quickly once i have the ip.

    Still no idea why it benefits someone to DDOS the site. Probably some gob****e with a wrong ip or something.


  • Options
    #5
    Media999
    Registered Users Posts: 1,695 ✭✭✭Media999


    Colonel Panic wrote: »
    What's showing up in your web server's logs? How about using Fail2Ban to monitor your server logs and generate iptables rules?

    How do i setup Fail2ban? Im not too up with this stuff. netstat is as advanced as i get :pac:


  • Options
    #6
    professore
    Closed Accounts Posts: 5,857 ✭✭✭professore


    Amazing some a**hole is at this on the day after Christmas. Must have a pathetic life.


  • Advertisement
  • Options
    #7
    Prodigious
    Closed Accounts Posts: 2,827 ✭✭✭Prodigious


    DDos them back would be my advice.


  • Options
    #8
    BrokenArrows
    Registered Users Posts: 7,501 ✭✭✭BrokenArrows


    Well is there any reason why someone would want to cause harm to your website?

    If not then its just someone getting their ****s and giggles.


  • Options
    #9
    Media999
    Registered Users Posts: 1,695 ✭✭✭Media999


    Methememb wrote: »
    DDos them back would be my advice.

    As much as id love to i just cant be bothered.

    Makes no sense at all why they do it. Its not even possible that someones losing money from competition as its not a money site.

    Sorted now anyway so couldnt care now.

    Cheers


Advertisement