Creating a canonical "Help, I'm Getting DDOS-ed!" question?

Question

Another Distributed Denial of Service question (and this one) floated into the review queue. Is there any interest in creating a canonical question and answer for all of D/DOS questions that we see?

I'm of the opinion that for 90% of the audience here (myself included) the appropriate answer to "Help! I'm being D/DOS-ed" questions is for them to contact their upstream provider, be it their ISP's security team, their co-location facility's network team or their shared hosting / VPS provider and ask them to intervene. The proliferation and the ease of use of tools like Low Orbit Ion Cannon, not to mention the ubiquity of botnets, has created a threat environment where pretty significant D/DOS attacks are a relatively simple affair and defending against them often takes specialized knowledge and infrastructure that is beyond most administrators. No amount of gyrations performed on the host can truly mitigate one of these attack (i.e., Fail2Ban and iptables rate-limit just doesn't cut the mustard).

Thoughts?

Answer 1

We should First of all see if a suitable Q&A already exists and if one does it should be made into our canonical. If one doesn't exist then we should make one.

Once we have a canonical Q&A we should arrange an event with the co-operation of the moderators and get as many people as possible to work through the relevant searches/tags.

It should be possible to only cast one close->duplicate of canonical per question and have the mods cast the second binding vote to get the job done.

Answer 2

I've gone ahead and created one:

I am under DDoS. What can I do?

I think it's pretty comprehensive, but of course I'm sure it can be improved upon. Let's close a bunch of things as a duplicate of it.

Answer 3

Most providers just null-route the server/VPS when under DDoS. Telling people to "contact their upstream provider" is not a solution at all in most cases. Providers just don't want to continue providing service to you, they don't want to fight for you, they just null-route. They care about their network, not you.

In fact this null-route is usually automatic: once they detect more than (for example) 250Mbps. And of course the null route is not removed automatically, you have to open a ticket and wait till they want to connect your server again.

So, in my opinion, a useful answer would be:

Is it a DDoS attack? How many Mbps do you see in the traffic graphs (if your provider gives you that information)? Can you access the server? If so, please execute the following commands: [commands to see active connections, tcpdump and stuff like that]

Depending on the answers to these questions:

1. Attack is above 100Mbps -> you can't filter it with iptables (unless you have a 1Gbps VPS, kinda weird). You need a DDoS protected proxy (CloudFlare for example) or a hardware firewall. [Explain how a proxy works. Important features when looking for a proxy (allow any port, not only :80 for example), the importance of hiding the real IP behind the proxy (for example when sending emails)...]

2. Attack is less than port bandwidth -> you can try to filter packets. What kind of DDoS are you facing? SYN flood? Check syn-cookies [add more tips and guidance depending on DDoS type]

This will not solve DDoS attacks, but would help people understand what's happening, why the attack works, what they can/can't do to stop or mitigate it...
Once they know what kind of attack they are suffering and how it works they can ask for more specific help: Questions like "how to stop DDoS attack" become "how to limit connections per /24 IP range" or "configure mail relay server"...

Answer 4

Would it be on-topic at serverfault ?

There are already some questions about this at security.stackexchange, for example this one which mentions a few options in the second answer, or this other one which mentions mitigation partners.

Answer 5

There's nothing anyone on SF can really advise people to do except contact their upstream provider ...I don't think a canonical would be useful because of this case. Instead, a comment with "contact your upstream provider" would be appropriate. Plus, these questions aren't all that common from what I've seen.