DDOS, short for Distributed denial of service attacks plague businesses and websites
around the world. A DDoS attack occurs when a target server or website
is overwhelmed with communication requests from a botnet or group of
attackers. Once the server is no longer able to handle HTTP requests, it
goes offline and prevents legitimate users from being able to access
the website.
Botnets are typically used in conjunction with a DDoS attack. It takes a considerable amount of resources to take a website offline. In order to be effective, attackers must combine the resources of multiple computers. DDoS attacks typically do not cause damage to a website - they simply make the website inaccessible. There are more malicious uses of DDoS attacks. They are now being used as a way to deter security personnel and cover up fraud. In either case, if you own a website, you should be aware of how to recognize an attack.
How Do You Know If You Are Being HIt With A DDoS Attack?
The most important thing to do is not jump to conclusions. You want to check your router, internet connection, and any other variables that can be affecting your website performance. If you determine that it is not an internet connection problem, the first action you should take is contacting your web hosting provider. They will be able to tell you immediately whether you are being attacked or not.
The United States Computer Readiness Team, or US-CERT, gives a list of symptoms that serve as pointers that your computer resources may be under attack. Here is what they list as the potential signs of a DDoS attack:
The time it takes to transmit 32 bytes of data is normally about 40ms. At the initial stages of a DDoS attack, this may take 800ms. The computer system will eventually respond with a "Request Timed Out". Overall, identifying the initial stages of a DDoS attack early on, it's possible to prevent your computer and network resources from completely being taken offline.
If you are the do-it-yourself type, network administrators can make use of NETSTAT. This allows the administrator to see all the current TCP/IP connections. A large number of TCP/IP connections from the same IP address is usually a good indication of an attack. You can confirm that an attack is in progress when the state of these connections indicates SYN_RECEIVED.
To find out the IP address targeting your network, run the TCPView program or any program that indicates all the current connections on a computer. You can also use the commands found below to do some further research yourself.
This can be tricky for most and nearly impossible without the right combination of hardware, software, and experience. If you happen to fall victim to a DDoS attack, contact your hosting provider immediately. If they are unable to mitigate the attack, there are two options available to you:
Botnets are typically used in conjunction with a DDoS attack. It takes a considerable amount of resources to take a website offline. In order to be effective, attackers must combine the resources of multiple computers. DDoS attacks typically do not cause damage to a website - they simply make the website inaccessible. There are more malicious uses of DDoS attacks. They are now being used as a way to deter security personnel and cover up fraud. In either case, if you own a website, you should be aware of how to recognize an attack.
How Do You Know If You Are Being HIt With A DDoS Attack?
The most important thing to do is not jump to conclusions. You want to check your router, internet connection, and any other variables that can be affecting your website performance. If you determine that it is not an internet connection problem, the first action you should take is contacting your web hosting provider. They will be able to tell you immediately whether you are being attacked or not.
The United States Computer Readiness Team, or US-CERT, gives a list of symptoms that serve as pointers that your computer resources may be under attack. Here is what they list as the potential signs of a DDoS attack:
- Unusually slow network performance (opening files or accessing websites).
- Unavailability of a particular website.
- Inability to access any website.
- Dramatic increase in the amount of spam you receive in your account.
The time it takes to transmit 32 bytes of data is normally about 40ms. At the initial stages of a DDoS attack, this may take 800ms. The computer system will eventually respond with a "Request Timed Out". Overall, identifying the initial stages of a DDoS attack early on, it's possible to prevent your computer and network resources from completely being taken offline.
If you are the do-it-yourself type, network administrators can make use of NETSTAT. This allows the administrator to see all the current TCP/IP connections. A large number of TCP/IP connections from the same IP address is usually a good indication of an attack. You can confirm that an attack is in progress when the state of these connections indicates SYN_RECEIVED.
To find out the IP address targeting your network, run the TCPView program or any program that indicates all the current connections on a computer. You can also use the commands found below to do some further research yourself.
- netstat -n -p | grep SYN_REC | sort -u
- netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'
- netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
- netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
- netstat -plan|grep:80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
This can be tricky for most and nearly impossible without the right combination of hardware, software, and experience. If you happen to fall victim to a DDoS attack, contact your hosting provider immediately. If they are unable to mitigate the attack, there are two options available to you:
- Subscribe to a DDoS proxy protection service. WIth proxy protection, there is no need to switch from your current host. The DDoS protection provider will simply re-route your DNS settings to point towards their servers to "scrub" the malicious traffic from your pipeline. They will then route the legitimate traffic back to your website.
- Switch to a web host that provides DDoS protection. This is more a solution for high profile websites, or webmasters that are constantly plagued with DDoS attacks. In this case, moving to a host that specializes in DDoS protection is the best option.
