About preventing ddos?

Forum Moderators: phranque

Message Too Old, No Replies

About preventing ddos?

I get headache with the unknown guys who always attack my site !

redstrike

6:21 pm on Jun 12, 2007 (gmt 0)

Hi, everyone!

I am a Vietnamese webmaster. Can you help me about preventing ddos?

I get headache with the unknown guys who always attack my site!

<snip>

I have checked access log but it didn't have refer, header,..etc

Can you give me some solution for this problem?

Thansks so much!

[edited by: trillianjedi at 3:07 pm (utc) on June 13, 2007]
[edit reason] Please see TOS. Thanks ;) [/edit]

trillianjedi

3:07 pm on Jun 13, 2007 (gmt 0)

Welcome to WebmasterWorld redstrike!

What webserver are you running? Is it a dedicated or shared server?

redstrike

6:04 am on Jun 14, 2007 (gmt 0)

I am using a shared hosting!

My webserver is Apache 1.3.37 (Unix)

Thanks for your remind!

trillianjedi

11:29 am on Jun 14, 2007 (gmt 0)

First thing you need to do is analyse what's happening.

Check IP addresses and useragents in the logfile. Spot any patterns?

redstrike

5:23 pm on Jun 17, 2007 (gmt 0)

I have looked the log file...

Some IP request so much... and they have started with a POST method!

They used Mozilla FF!

I have spent > 20 min to block them manualy!

trillianjedi

10:02 am on Jun 18, 2007 (gmt 0)

I have spent > 20 min to block them manualy!

Thems the breaks!

You can automate a lot of this stuff. Have a google around for "bot traps". You can also set up scripts to detect single IP based activity that can't be human (pulling pages too fast etc).

But nothing beats the human eye.

vincevincevince

10:12 am on Jun 18, 2007 (gmt 0)

An effective DDOS will use many computers, seen by many IP addresses. If you are rolling over from just one guy, you probably need to either optimise your code or get a better server ANYWAY.

I'm glad you found the person who was causing the problem. In general, your datacenter should be stopping DDOS before they even get to you - I'd have a chat with them about it - this kind of thing is much better handled on a hardware and routing level than on your server itself.