Welcome to the Linux Foundation Forum!

How to determine if I'm under the attack of DDoS?

Options
themez45
themez45 Posts: 1
in Network Management

Hello!
How to determine if I'm under the attack of DDoS?
Considering I'm using Linux 18.04 Ubuntu operating system, running a gaming server on it with 200 players daily, yet some people experience heavy rubberbanding;
The internet speed is 1GBit/s, and tcpdump shows;
49151 packets captured
101057 packets received by filter
51895 packets dropped by kernel

What are these "dropped" packets? I've read that increasing buffer size of tcpdump would be necessary to use, if you have dropped packets, yet I cannot understand exactly what does tcpdump mean by 'dropped' packets. Host says that I am experiencing 1.99Gbit/s DDoS attack, but I don't really believe them.

Comments

  • techinfozone
    techinfozone Posts: 15
    Options

    The most effective way to mitigate a DDoS attack is to know when it’s happening immediately when the attack begins. There are several clues that indicate an ongoing DDoS attack is happening:
    1. An IP address makes x requests over y seconds
    2. Your server responds with a 503 due to service outages
    3. The TTL (time to live) on a ping request times out
    4. If you use the same connection for internal software, employees notice slowness issues
    5. Log analysis solutions show a huge spike in traffic
    Most of these signs can be used to automate a notification system that sends an email or text to your administrators.

Categories

Upcoming Training