These are few steps to be taken when you feel that the server is under attack:
--------------------------------------------------------------------------------
-
Step 1: Check the load using the command "w".
Step 2: Check which service is utilizing maximum CPU by "nice top".
Step 3: Check which IP address is taking maximum connection using the command:
netstat -anpl|grep :80|awk {'print $5'}|cut -d":" -f1|sort|uniq -c|sort -n
netstat -an|awk '/tcp/ {print $6}'|sort|uniq -c
Step 4: Check the IP address of the server having maximum connection using the
command:
netstat -alpn | grep :80 | awk '{print $4}' | cut -d: -f1 |sort |uniq -c
Step 5: Then block the IP address using APF firewall "apf -d <IP address>" or
using CSF firewall "csf -d <IP address>
--------------------------------------------------------------------------------
-
In future, to avoid DDoS attack or to lower its intensity you can install the
following modules.
============
*Mod_security: Since DDoS often targets HTTP (port 80), it is a good idea to
have a filtering system for Apache. 'Mod_security' will analyze requests before
passing them to the web server.
*Mod_dosevasive: This is an Apache module which performs 'evasive' action in the
event of an HTTP DDoS attack or brute force attack.
*(D)DoS Deflate: This is a shell script which assists in combating denial of
service attacks.
============
Please go through the following URLs for more information on how to install
"mod_security", "mod_evasive" and "dos_deflate" on your server:
-------------------
http://prasadnaik15.wordpress.com/how-to-prevent-ddos-attack/
-------------------
http://www.eth0.us/mod_evasive
-------------------
http://forum.whmdestek.com/security/758-mod_security-installation.html
-------------------
You can also enable Sysctl protection against DDoS. Please go through the
following URL for more information in this regard:
----------
http://forums.softlayer.com/showthread.php?t=304 [use your portal
username/password to login]
As mentioned by others, having some connections in TIME_WAIT is a normal part of the TCP connection. You can see the interval by examining /proc/sys/net/ipv4/tcp_fin_timeout:
[root@host ~]# cat /proc/sys/net/ipv4/tcp_fin_timeout
60
And change it by modifying that value:
[root@dev admin]# echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
Or permanently by adding it to /etc/sysctl.conf
net.ipv4.tcp_fin_timeout=30
Also, if you don't use the RPC service or NFS, you can just turn it off:
/etc/init.d/nfsd stop
And turn it off completely
chkconfig nfsd off
