Site being DDOSed

Media999

Bit of a strange one here. Usually i can just block an ip from netstat and problem solved but this time all that shows up is

tcp        0      0 localhost.localdomain:http  msnbot-65-55-24-236.s:53841 TIME_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:56733 CLOSE_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:53713 CLOSE_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:46631 CLOSE_WAIT
tcp        0      0 localhost.localdomain:http  hst-164-224.duomenuce:49695 CLOSE_WAIT

iptables blocking wont work. Any solution for this? Some fool from Latvia is repeatedly at this. No idea why it benefits them in any way.

BrokenArrows

The host might be hst-164-224.duomenucentras.lt

duomenucentras.it supplies servers for rent.

Colonel Panic

What's showing up in your web server's logs? How about using Fail2Ban to monitor your server logs and generate iptables rules?

Media999

Cheers for the help folks. I just went out and left it. Just back and got this command off my host

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Really nice way of finding whos attacking. never had to use it before as an ip would just show up. Pretty much have all bases covered with that as it only happens once every couple of months and im able to stop it fairly quickly once i have the ip.

Still no idea why it benefits someone to DDOS the site. Probably some gob****e with a wrong ip or something.

Media999

Colonel Panic wrote: »

What's showing up in your web server's logs? How about using Fail2Ban to monitor your server logs and generate iptables rules?

How do i setup Fail2ban? Im not too up with this stuff. netstat is as advanced as i get :pac:

professore

Amazing some a**hole is at this on the day after Christmas. Must have a pathetic life.

Prodigious

DDos them back would be my advice.

BrokenArrows

Well is there any reason why someone would want to cause harm to your website?

If not then its just someone getting their ****s and giggles.

Media999

Methememb wrote: »

DDos them back would be my advice.

As much as id love to i just cant be bothered.

Makes no sense at all why they do it. Its not even possible that someones losing money from competition as its not a money site.

Sorted now anyway so couldnt care now.

Cheers