Distributed denial-of-service attack (DDoS –Distributed Denial of Service) is a form of attack that overloads a computer system or network, preventing a service from operating normally or forcing it to shut down. In a DDoS attack, the target server is "flooded" with a huge volume of access requests generated simultaneously from many different sources.
When the volume of requests exceeds the server's processing capacity, system resources are exhausted and the server can no longer serve legitimate requests. As a result, users cannot access or use the services on the website, and the system is left under attack.
In the section below I introduce a few basic commands for checking and assessing the state of a server when you suspect a DDoS attack.
– Count the number of connections to Port 80:
netstat -n | grep :80 |wc -l– Check how many connections are in the SYN_RECV state:
netstat -n | grep :80 | grep SYN_RECV|wc -l- Show all connected IP addresses and the number of connections from each:
netstat -an|grep :80 |awk '{print $5}'|cut -d":" -f1|sort|uniq -c|sort -rn– To check which IPs are opening many SYNs, add:
netstat -an|grep :80|grep SYN |awk '{print $5}'|cut -d":" -f1|sort|uniq -c|sort -rn– On a server with multiple IPs, to see which IP is under attack:
netstat -plan | grep :80 | awk '{print $4}'| cut -d: -f1 |sort |uniq -c- Show all connected IP addresses and the number of connections from each:
netstat -an | grep ':80' | awk '{print $5}' | sed s/'::ffff:'// | cut -d":" -f1 | sort | uniq -c– Show the number of connections per type
netstat -an | grep :80 | awk '{print $6}' | sort | uniq -c61 ESTABLISHED
13 FIN_WAIT1
17 FIN_WAIT2
1 LISTEN
25 SYN_RECV
298 TIME_WAIT– Shows every connected IP and the number of connections from each
watch "netstat -an | grep ':80' | awk '{print \$5}' | sed s/'::ffff:'// | cut -d\":\" -f1 | sort | uniq -c"watch "netstat -an | grep :80 | awk '{print \$6}' | sort | uniq -c"Once you have identified an IP behaving suspiciously, you can use CSF to block it.
