Identify a DoS/DDoS attack


If your server appears pretty slow, there could be many things wrong such as poorly written scripts - but sometimes it could be because someone is flooding your server with traffic known as DoS (Denial of Service) or DDoS (Distributed Denial of Service). It could also be that your server itself is part of a botnet and is being used to attack other networks. In this case it is always a good idea to run scans with software such as ClamAV and RootKit Hunter as a precaution.

Furthermore, whenever a client connects to a server via a network, a connection is established and opened on the system. On a busy high-load server, the number of connections connected to the server can be hundreds if not thousands. Find out and get a list of connections on the server. 
Take a look at these handy netstat commands below that will surely help you determine whether your under attack or are part of an attack.

netstat -na
Displays all active Internet connections to the server and only established connections are included.

netstat -an | grep :80 | sort
Shows only active Internet connections to the server on port 80 and sorts the results. This is useful in detecting a single flood by allowing you to recognize many connections coming from one IP.

netstat -n -p|grep SYN_RECV | wc -l
This command is useful to determine how many active SYN_RECV are occurring on the server. The number should be pretty low, preferably less than 5. On DoS attack incidents or mail bombs, the number can jump pretty high. However, the value always depends on the system, so a high value may be average on another server.

netstat -n -p | grep SYN_RECV | sort -u
Lists all IP addresses involved.

netstat -n -p | grep SYN_RECV | awk '{print $5}' | awk -F: '{print $1}'
Lists all the unique IP addresses that are sending SYN_RECV connection statuses.

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
Uses the netstat command to calculate and count the number of connections each IP address makes to the server.

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
Lists the number of connections the IP's are making to the server using the TCP or UDP protocol.

netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
Checks on ESTABLISHED connections instead of all connections, and displays the number of connections for each IP.

netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
Shows a list of IP addresses and the number of connections that are connecting to port 80 on the server. Port 80 is used mainly by the HTTP protocol.

If you have detected a high number of connections, you can use iptables to block them (handy tool - CSF) or you can limit connections by simply configuring our pre-built firewall in the client area

Was this answer helpful?

 Print this Article

Also Read

Secure VPS Tips

Here is a simple, straightforward guide to improve VPS security. Change the SSH port One of the...

Make cPanel/WHM VPS more secure

Use secure passwords Insecure passwords are the most common security vulnerability for most...

Secure mail server checklist

Setup of email server in Linux is simple, but your job does not end there. Customer had...

Working with a compromised VPS

An exploited or hacked VPS is one that is no longer fully under your control. Someone else is now...

Use PING to find network problems

PING allows you to quickly verify the connectivity of your internet connection to the VPS server....