How do I stop a DDOS attack?
- Thread starter Belhassen
- Start date
root012
Member
- Oct 26, 2015
- 22
- 0
- 43
Hello, The only way is to buy a vps having DDoS protection. If you have a vps without DDoS protection is not possible to protect without any additional hardware.
Try, www.digital-hosting.biz Have good ddos protection for ts3 OVH GAME cheap vps
good luck
Try, www.digital-hosting.biz Have good ddos protection for ts3 OVH GAME cheap vps
good luck
Belhassen
ʙᴇʟʜᴀssᴇɴ
- Jul 29, 2016
- 59
- 16
- 83
- Thread starter
- #3
Hello, The only way is to buy a vps having DDoS protection. If you have a vps without DDoS protection is not possible to protect without any additional hardware.
Try, www.digital-hosting.biz Have good ddos protection for ts3 OVH GAME cheap vps
Thank you for your reply, but I want to know is what there is an average to know who ddos me?
MwZ
Active Member
- Dec 27, 2016
- 47
- 6
- 83
It depends how much you want to pay, because you cannot stop a DDoS Attack by yourself, it requires special DDoS Mitigation gear to "mitigate" or in other words, "reduce the impact" of this attack as much as possible to keep your stuff working at minimum impact/issues. Cheap solutions will help, but they aren't the final solution, unless you really want to pay for a better/serious company, providing you with better technologies or support services...
Back to the subject, you can stop small DoS attacks, with iptables or CSF, but this is also not a final solution...
run a tcpdump during attack and save it as pcap file and open it with wireshark.
From there you can investigate which port is being attacked, who is attacking, and what kind of attack it is.
Easiest (and most CPU intensive) way is to block the attack by hex if the packets are all same..
For example one of my rules:
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|fa163eb402096ac8|' --algo kmp -j DROP
You can see that I had no other choice to block by hex since the attack is coming to port 9987. If it was coming to the port 5555 for example, I could just drop all traffic related to that port and not worry about the hex filtering taking up my CPU core to 80%. Even better way is to block the attack on network level using control panel of your hosting provider.
From there you can investigate which port is being attacked, who is attacking, and what kind of attack it is.
Easiest (and most CPU intensive) way is to block the attack by hex if the packets are all same..
For example one of my rules:
iptables -A PREROUTING -t raw -p udp --dport 9987 -m string --hex-string '|fa163eb402096ac8|' --algo kmp -j DROP
You can see that I had no other choice to block by hex since the attack is coming to port 9987. If it was coming to the port 5555 for example, I could just drop all traffic related to that port and not worry about the hex filtering taking up my CPU core to 80%. Even better way is to block the attack on network level using control panel of your hosting provider.
MwZ
Active Member
- Dec 27, 2016
- 47
- 6
- 83
This is not necessary to be done with modern protection systems...
tcpdump -s 0 -i eth0 -w dump.pcap
Then open dump.pcap with wireshark on your local computer to see whats in there.
You might want to correct your network interface card above. run ifconfig to find the exact name and replace eth0 with that. It could be something like venet0:0 for example if you have OpenVZ server.
I explained very extensively how to analyze and block traffic with iptables in this thread: https://r4p3.net/threads/ovh-ddos-protection-block-ts3-attack.3060/ (Scroll down to my post)https://r4p3.net/threads/ovh-ddos-protection-block-ts3-attack.3060/
MwZ
Active Member
- Dec 27, 2016
- 47
- 6
- 83
You can simply write a script to attack all the IPs at once... :/
MwZ
Active Member
- Dec 27, 2016
- 47
- 6
- 83
That's easier than you guess, specially with tsdns...
MwZ
Active Member
- Dec 27, 2016
- 47
- 6
- 83
This is even easier, because you can simply list all IPs of your A entry with a simple command and then write a script in less than a minute to knock all these IPs. And no, a paid botnet is not necessary, but just a simple VPS. And well, maybe there aren't ways to get 100% protection, but you can get close to it using better companies that doesn't require you to take any sort of action in your end, mainly when speaking about TeamSpeak 3, But this is not going to be cheap anyways...
hellmind
Active Member
- Jul 13, 2015
- 18
- 3
- 78
Well for me having many ip, and choose to switch fast the ddosed ones save me many times.
Also is very useful when there are not good and cheap anti ddos providers.
I think the best for canada is OVH
USA nfoservers ?
South america (maybe in brazil?)
EUROPE dont know( ovh isnt working great for me there)
Also is very useful when there are not good and cheap anti ddos providers.
I think the best for canada is OVH
USA nfoservers ?
South america (maybe in brazil?)
EUROPE dont know( ovh isnt working great for me there)