Options to stop a DDOS attack

[Marco van Herwaarden]

Just add password protection in the way you prefer (from cPanel??). Just make sure that you put the username/password also in the text of the login, so regular visitors (ie. humans) can read it and login. This will stop all bots.

[testbot]

just a note... that will also block good bots like google.

i like that idea though. good to add to my tool box.

[Dismounted]

It's not a permanent solution - just to stop a single attack.

[Marco van Herwaarden]

Yes this will stop all automated processes including SE-spiders, but that is a small price to pay. And like dismounted mentioned, this is a solution only usable for a short time but most attacks don't run longer then a few days.

The story from yesterday did get a strange twist. After deploying the extra login trick, we decided to also ask the host to place us behind an extra firewall to further help mitigating the attack. At the time the server was placed behind the firewall, the server (with extra login) was under a high load, but forums where usable. During the day the forums became less and less responsive until they where almost unreachable by the nd of the day. Server load however was still low. After long time of troubleshooting we decided to remove the firewall again to see what happens. Guess what, serverload stayed within reasonable limits, forums where accessible at a good speed again. So in this case the firewall actually did make things worse instead of solving it (although the host doesn't want to admit this).

[testbot]

the host never admits fault for ANYTHING. :lol:

i'm always amazed at the amount of attacks we get from random countries. it's always something.

good post.

[motowebmaster]

When I owned a much larger vb site, a dedicated Cisco ASA Firewall provided basic protection. When DDOS attacks would happen, my host would move my public network interface (before my firewall) to a special network segment that was equipped with DDOS mitigation technology and let it run there for 24-48 hours. It didn't happen often, but represented the "no additional charge" means of dealing with some mean attacks. At the time, my primary webserver was an Dual Quad Core machine and on some occasions it would be brought to a crawl until mitigation was activated.

There aren't that many service providers who do this, but the idea is catching on. Ask your service provider about it.