Is there a mod to help with ddos attacks?

[Nick1337]

Hello, is there a mod to help with DDoS attacks?

My host has firewalls installed but yet I am still getting hit with a DDoS attack and he is doing something with a whole bunch of ip's just from his computer..

They are using sitename.com/forum.php?t=15168 or sitename/showthread.php?t=15168

I forget which but it was one of the two..

So what are some possible things i can do?

THANKS
Nick

[Lynne]

I don't think you can do anything except wait it out. We got hit last September - it started abruptly Thursday afternoon and ended just as abruptly Tuesday morning. I was frazzled the whole time, but they finally just left.

The only thing we did is my server guy installed a script that banned IPs if they were hitting the server too much in a short period of time. All this really did is make it so my users could finally get onto the site, but the site was working very, very slowly.

[Nick1337]

Well its been happening a long time... i know who it is but he is a server administrator and has like 2 offshore proxys filtering all his activity so i can't report him to his ISP..

I have had like 20 differants hosts in the past week and the one i have now is the best one.. but do you know which script he installed?

[snakes1100]

If you have ssh access to the server as a su user, you should drop the ips that he is using iptables

If your host has ddos protection in place, then they arent doing a very good job of it, they should be ip banning at the router.

[Nick1337]

He has some type of botnet, and we have banned a lot of ips already

[Lynne]

Originally Posted by Nick1337

Well its been happening a long time... i know who it is but he is a server administrator and has like 2 offshore proxys filtering all his activity so i can't report him to his ISP..

I have had like 20 differants hosts in the past week and the one i have now is the best one.. but do you know which script he installed?

It was a script he wrote himself. All it did was grab the IPs and throw them into a file which was then read by the iptables (or something like that). And it was run as a cron job every ten minutes. So, really, all it did was grab the IPs of the users that were pounding the server *at that time* and ban them. It did not fix things on the site in anyway. As I said, it just allowed us to get on if we were really, really patient (but some of my users needed to get on to get access to information).

[Nick1337]

Ok, if anyone knows of anything please post

--------------- Added [DATE]1205164688[/DATE] at [TIME]1205164688[/TIME] ---------------

This is what im getting in emails:

Database error in vBulletin :

mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Too many connections
/home/public_html/includes/class_core.php on line 316

MySQL Error :
Error Number :
Date : Monday, March 10th 2008 @ 12:49:12 AM
Script : http://sitename.com/showthread.php?t=28528
Referrer :
IP Address : 90.154.171.27
Username :
Classname : vB_Database
MySQL Version :

Database error in vBulletin :

mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Too many connections
/home/public_html/includes/class_core.php on line 316

MySQL Error :
Error Number :
Date : Monday, March 10th 2008 @ 12:49:13 AM
Script : http://sitename.com/showthread.php?t=28528
Referrer :
IP Address : 86.135.161.112
Username :
Classname : vB_Database
MySQL Version :

Database error in vBulletin :

mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Too many connections
/home/public_html/includes/class_core.php on line 316

MySQL Error :
Error Number :
Date : Monday, March 10th 2008 @ 02:19:36 AM
Script : http://sitename.com/showthread.php?t=28528
Referrer :
IP Address : 213.165.56.190
Username :
Classname : vB_Database
MySQL Version :

Database error in vBulletin :

mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Too many connections
/home/public_html/includes/class_core.php on line 316

MySQL Error :
Error Number :
Date : Monday, March 10th 2008 @ 12:48:58 AM
Script : http://sitename.com/showthread.php?t=28528
Referrer :
IP Address : 88.242.211.141
Username :
Classname : vB_Database
MySQL Version :

I have had up to 22,000 of these at a time..

[Lynne]

I would suggest turning off sending the error emails because they are just going to be causing more problems for your poor server. (I'm just suggesting turning it off for now. You *know* there are site problems and don't need all the emails telling you so right now.)

[Nick1337]

Eh, i can't login to do so

a way to do it from config.php?

[snakes1100]

Remove the tech email address from the config.php file.

To many connections to the db dont mean there is a ddos attack happening, what is the max_connection set at in the my.cnf file and how many users are onlin in the forum on avg?