Penetration Testing mailing list archives
RE: DoS problem.
From: "Steve McLaughlin" <Steve.McLaughlin () aggreko co uk>
Date: Mon, 23 Jan 2006 12:40:01 -0000
Call the ISP, they can usually isolate it from there... -----Original Message----- From: Jorge Alfredo Garcia [mailto:frederix () gmail com] Sent: 20 January 2006 18:02 To: pen-test () securityfocus com; firewalls () securityfocus com Subject: DoS problem. I have two dedicated servers, both hosted by the same provider and both on the same segmnet. I am under a denial of services attack but idont know exactaly how to stop it. Here is a piece of my netstat output: tcp 0 1 XX.XX.XX.AA:47561 XX.XX.XX.BB:80 SYN_SENT tcp 0 1 XX.XX.XX.AA:47562 XX.XX.XX.BB:80 SYN_SENT tcp 0 1 XX.XX.XX.AA:47565 XX.XX.XX.BB:80 SYN_SENT tcp 0 1 XX.XX.XX.AA:47564 XX.XX.XX.BB:80 SYN_SENT tcp 0 1 XX.XX.XX.AA:47567 XX.XX.XX.BB:80 SYN_SENT Ok, XX.XX.XX.AA is the server i am in now. XX.XX.XX.BB is mine two and here are the connections: tcp 0 0 XX.XX.XX.BB:80 XX.XX.XX.AA:50749 SYN_RECV tcp 0 0 XX.XX.XX.BB:80 XX.XX.XX.AA:50598 SYN_RECV tcp 0 0 XX.XX.XX.BB:80 XX.XX.XX.AA:50309 SYN_RECV I have thousands of this connections on both servers. I make iptables rules in both sites but the attack still running and the rules dont work. I cant understand how this attack can be made taking into account that the attacker isnt inside any of my servers. Why iptables rules dont work against this? Thanx in advance. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. ______________________________________________________________________ Visit us at http://www.aggreko.com Confidentiality Notice: This communication and any accompanying attachments contain confidential information intended for a specific individual and purpose. This communication is private and protected by law. If you are not the intended recipient, you are hereby respectfully notified that any disclosures, copying, forwarding or distribution, or the taking of any action based on the contents of this communication is strictly prohibited. _____________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Re: DoS problem. Volker Tanger (Jan 21)
- <Possible follow-ups>
- Re: DoS problem. Matthew Baker (Jan 21)
- RE: DoS problem. Steve McLaughlin (Jan 23)