The epic guide to filtering DDoS attacks

[Djlatino]

I feel it needs a sticky

Djlatino Reviewed by Djlatino on 14th May 2011. The epic guide to filtering DDoS attacks This thread will probably end up in the tutorials section eventually, but for now I'll place it here. It should be a pretty handy guide for a lot of people. DDoS attacks aren't uncommon and sometimes it's possible to filter them out server side, sometimes not. For the times that are however, the following suggestions should be pretty handy. These are mainly for the "common HTTP flood". There are many, many types of attacks, but we'll focus on this one for now. This guide will assume a few of Rating: 5

[shakhawat]

Useful post for dedi/vps, but any solution for shared hosting!?

[mayank101]

wow awesome elight thanks for d info..

[Virtual]

very useful information,

thanks!

[XForce!]

+Rep!
Bookmarked Very Helpful...

[World Life]

Awesome tut

[soft2050]

Thanks for this epic guide.

[damnyou]

Very nice guide
It will not work against syn flood.

[JmZ]

Just an FYI, there's no need for any the perl.

tail -n 300 access.log | grep libwww | wc -l
tail -n 300 access.log | grep -oE '^\b[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\b' | uniq -c | sort -n

[eLight]

You're right, grep is multi threaded whilst Perl isn't. Though the performance difference would be miniscule grep is more than likely faster. Everything that's done in the Perl could be done with awk and grep.

Old habits die hard though, I still love Perl for text manipulation.