Massive DDos Attack.

[Biker_GA]

Originally Posted by snakes1100

1. Your host should be blocking this ddos attack at the router, NOT at your server.

2. If your host cant block a ddos attack, i'd suggest a new host.

3. Did you even check the logs to see what type of attack it actually is or netstat the current connections on the server?

Exactly. If the host is unwilling or unable to modify the router tables, it's definitely time for a new host.

The only exception to this would be if the host is running a dedicated firewall. At that point, you modify the firewall rules to block the offending IP blocks.

[TNCclubman]

Theres a program out there (for the server level) that will automatically forward IP's that hammer you to any other url you want. Kind of like an automatic deflector shield. I'll try looking for it for you on google.

[Biker_GA]

The host should not be running any type of firewall on a production server. In a data center environment, dedicated boxes are needed for firewall applications. If a host is attempting to have a production server do anything other than what it's to be used for, it's DEFINITELY time to find a new host.

[snakes1100]

Originally Posted by TNCclubman

Theres a program out there (for the server level) that will automatically forward IP's that hammer you to any other url you want. Kind of like an automatic deflector shield. I'll try looking for it for you on google.

So, seeing as the flooder is requesting responses on port 80 or whatever port, which right now the server is being flooded and now not responding, it would be wise to answer his requests and then forward his requests to a new address?

So how exactly would that solve the flood issue coming from the ip?

[bigcurt]

I didn't setup this thread to bash my host, as they have been nothing but great to me and I believe have done a ton to help me. So, everyone please do not turn it into that. Thanks everyone for their help so far! Still down though .

[royo]

Originally Posted by TNCclubman

Theres a program out there (for the server level) that will automatically forward IP's that hammer you to any other url you want. Kind of like an automatic deflector shield. I'll try looking for it for you on google.

It doesn't work like that. If you have no networking experience don't post stuff you've heard from a friend of a friend.

[COBRAws]

We suffer from DDoS every 2 or 3 months, dont ask me why because I dont know.

The best solution for me was to deploy IPTables, a good firewall and just in case, have a load balancer with mirrored data on diff servers.

U're on a VPS, so there isn't much u can do, just ask your hosting provider, since you cant "touch" hardware nor software.

[snakes1100]

Originally Posted by COBRAws

We suffer from DDoS every 2 or 3 months, dont ask me why because I dont know.

The best solution for me was to deploy IPTables, a good firewall and just in case, have a load balancer with mirrored data on diff servers.

U're on a VPS, so there isn't much u can do, just ask your hosting provider, since you cant "touch" hardware nor software.

Can't touch "software" on a VPS, since when? VPS's come with root access, you can touch anything you want software wise.

[fum1n]

Read your PM

[bigcurt]

Checked.