DDOS, or Distributed Denial of Service is an advanced version of DOS(Denial of Service) attack. Like DOS, DDOS also tries to deny important services running on a server by broadcasting packets to the destination server in a way that the Destination server cannot handle it.
There is no 100% perfect solution for DDOS. We can just prevent it to certain extend by securing our networks and servers. Here I am trying to explain the DDOS on HTTP, which is common in the webhosting Industry.
When you see your server load is increasing, it can be a result of DDos attacks to your server. You may use the command “w” to find the load in the server. If the load is not quite normal (Say above 5), you may check the following steps to see if a DDoS attack is going on.
Following command will give you a sorted list of IP addresses that are being connected to the server at port 80.
netstat -plan |grep :80 | awk ‘{print $5}’ |cut -d: -f1 |sort |uniq -c |sort -n
The result of the above command will list all IP addresses that are connected to the server on port 80. It will also show the number of connections of each IP addresses. A value below 10 is acceptable. That is there is not a problem with http connections to the server. If you find any IP addresses are having a large number of connections (Say 50), it should be double checked. It is always good to block the IP addresses in question. We ignore this and it may lead your server to go down!
You can use the following command to block the IP address.
