How to check if a Linux server is compromised by a DDoS attack

原文地址：http://www.phpthinking.com/archives/427

Log on to your server and execute the following command with the root user , using it you can check whether your server is in DDoS attack or not:
netstat-anp |grep ' tcp\|udp ' | awk ' {print $} ' | Cut-d:-f1 | Sort | uniq-c | Sort–n
This command will show that the logged on is the maximum number of IPs connected to the server List.

ddos become more complex, Because attackers use fewer connections, more IP-attacking servers, you get fewer connections, even if your server is attacked. It is important that you check the current active connection information for your server and execute the following command:
netstat-n | grep:80 |wc–l
The above command will show all active connections that open your server.

You can also use the following command:
netstat-n | grep:80 | grep SYN |wc–l

如果第二个命令的结果是100或以上，那么服务器可能被同步攻击。

一旦你获得了攻击你的服务器的IP列表，你可以很容易地阻止它。

同构下面的命令来阻止IP或任何其他特定的IP：

route add ipaddress reject

一旦你在服务器上组织了一个特定IP的访问，你可以检查对它的阻止豆腐有效

通过使用下面的命令：

route -n |grep IPaddress

您还可以通过使用下面的命令，用iptables封锁指定的IP。

iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT

service iptables restart

service iptables save

After the above command is executed, stop the HTTPD connection and restart the HTTPD service

使用下面的命令：

killall -KILL httpd

service httpd startssl

How to check if a Linux server is compromised by a DDoS attack