how to stop ddos attack on ip

DDoS is a distributed Dos attack (distributed denial of service attack). Through multiple hosts to a single server attack, that is, multiple hosts constantly to the server to initiate service requests, so that the server consumes a lot of CPU, memory, network bandwidth and other resources overwhelmed, can not provide n

原文地址：http://www.phpthinking.com/archives/427 Log on to your server and execute the following command with the root user , using it you can check whether your server is in DDoS attack or not: netstat-anp |grep ' tcp\|udp ' | awk ' {print $} ' | Cut-d:-f1 | Sort | uniq-c | Sort–n This command will show that the logged on is the maximum number of IPs connected to the server List.

The server is DDoS attack Defense shell script 1. Scripting Mkdir/root/bin vi/root/bin/dropip.sh #!/bin/bash /bin/netstat-na|grep Established|awk ' {print $} ' |awk-f: ' {print $} ' |sort|uniq-c|sort-rn|head-10|grep-v-e ' 192.168 |127.0′|awk ' {if ($2!=null $1>4) {print $}} ' >/tmp/dropip For I in $ (CAT/TMP/DROPIP) Todo /sbin/iptables-a input-s $i-j DROP echo "$i kill at ' Date '" >>/var/log/

: 17:50 P.M.With the previous attack experience, I began to observe the status of the web server. at, the load of the machine increased sharply. I can basically confirm that another round of attacks started.First, stop httpd, because it has been unable to move. Then capture the packet. tcpdump-c 10000-I em0-n dst port 80>/root/pkts finds a large influx of data packets, filters out IP addresses, and does not

security, you can set the maximum connection, single IP connection, and blacklist!Maximum connections:7000-> 30000 (LoginGate) is set to 40 single IP connection is set to: 207100-> 31000 (SelChrGate) is set to 30 single IP connection is set to: 207200-> 32000 (RunGate) is set to 1000 Single IP connection is set to: 20

addresses in the dropip through iptables, and then write them to the log file/var/log/ddos. Another method is to use php to write ddos attacks and use other cloud platforms for operations. Sinaapp is used as the test object. Test method: create four versions of the app. The homepage code of version 1 is as follows: File_get_contents ('HTTP: // 2.mars.sinaapp.com/'); // version 1 triggers an

its CC server, including obtaining the time and target of the start of the DDoS attack, uploading the information stolen from the host, and timing to encrypt the infected machine file. Why malware need unsolicited and cc service communication? Because in most cases malware is downloaded to the infected host by means of phishing emails , the attacker is not able to actively know who downloaded the malware a

anomalous incursion based on illegal data. The barrier anomaly is based on anomalies that are not normally disposed of by warehouses (even if they are completely legal from a normative point of view). The famous "Ping of Death" is about the massive (but still legitimate) ICMP Echo solicitation packet. If the packet has the same source address, policy address and port, it is still legal, but it is harmful to the IP protocol stack. Stale land incursio

This article describes the DDoS attack solution for PHP. Share to everyone for your reference. The specific analysis is as follows: Today, one of their own machine suddenly send a large number of packets outside, can be more than 1G per second, although I use the strategy of UDP ban packet is not sent out but very occupy the cup Ah, so think of the last to find a way to solve. First look at the source cod

Site was DDoS attack, so wrote a foot to resist, to achieve the way: 1. Attack characteristics, different IP constantly post Web page, resulting in excessive resource consumption2. Analyze Nginx Access log, Judge post feature to obtain Client access IP3. Attack

Anti-DDoS script # Lightweight prevention against SYN AttacksIptables-N syn-floodIptables-A input-p tcp-syn-J syn-floodIptables-I syn-flood-P TCP-m limit-limit 3/s-limit-burst 6-J returnIptables-a syn-flood-J reject # Prevent too many Dos connections. You can allow up to 15 Initial connections from each IP address of the Internet Nic, exceeding the limit of discardingIptables-A input-I eth0-P TCP-syn-M conn

1, server-side analysis method (1) Synflood attack judgment A: Network Neighborhood-> the "Properties"-> double click the NIC, the number of packets received per second is greater than 500. B: Start-> program-> attachment-> command prompt->c:\>netstat–na and observe a large number of syn_received connection states. C: After the network cable plugged in, the server immediately solidified cannot operate, unplug sometimes can restore, sometimes need

-refresh times$uri = $_server['Request_uri']; $checkip=MD5 ($IP); $checkuri=MD5 ($uri); $yesno=true; $ipdate=@file ($file);foreach($ipdate as$k =$v) {$iptem= substr ($v,0, +); $uritem= substr ($v, +, +); $timetem= substr ($v, -,Ten); $numtem= substr ($v, About); if($time-$timetem $allowTime) { if($iptem! = $checkip) $str. =$v; Else{$yesno=false; if($uritem! = $checkuri) $str. = $iptem. $checkuri. $time."1";ElseIf ($numtem 1) .""; Els

This article mainly introduces php's anti-ddos Solution. The example analyzes the principles and targeted solutions of the ddos attack program, which is a very practical technique, for more information about how to solve php ddos attacks, see the example in this article. Share it with you for your reference. The specif

First of all, we used to attack the client and the server configuration method, using the most famous Redhat Linux for testing, this attack test I use Fedora CORE3, the software is the most famous DDoS attack tool Tfn2k Linux version, The attacked Windows Server system uses the Windows2000server service to open the APA

Log on to your server with the root user to execute the following command, using it you can check whether your server is in a DDoS attack or not:NETSTAT-ANP |grep ' tcp\|udp ' |awk ' {print $} ' |Cut-d:-f1 |Sort |uniq-c | Sort–nThis command displays a list of the maximum number of IPs that are logged on that are connected to the server.DDoS becomes more complex, as attackers use fewer connections, more

Anti-DDoS: CC attack defense system deployment1. System effect this DDOS Application Layer defense system has been deployed on the http://www.yfdc.org site (if access fails, please directly access the server in China http: // 121.42.45.55 for online testing ). The defense system is at the application layer, which effectively prevents the abuse of server resources

The mod_evasive_1.10.1 Distributed Denial of service (ddos:distributed denial of service) attack refers to the use of client/server technology to unite multiple computers as an attack platform to launch DDoS attacks against one or more targets. Thus multiplying the power of denial of service attacks. As a result of DDoS