Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : DDOS

[James321]

Not sure if its in the right section.

Anywhom, I would like to know HOW I can determine if my dedicated machine is under a DOS attack. I have gotten Wireshark, but I am not able to determine if these IP's are sending enough information to cause a DDOS attack. Or is there another way to find out? Thanks!

[ClaudiuPopescu]

You have supplied way too less details.
If you are running a linux server you could check the connections using netstat (for the service you think is under attack).

[Secure_host]

you can find last 10 ips that send request to apache with this command

awk '{print $1}' /usr/local/apache/logs/access_log | sort | uniq -c | sort -rnk1 | head -n 10

[James321]

Server OS is Windows Server 08, not Linux. And im not running any website, they are Game Servers.

[Secure_host]

in windows server :

go to cmd.exe and then type :

netstat -aon
with this command a show all connection with tcp and upd that listening
n show all conntection with ip and port
o show pid of each connections
netstat -aon|find /c "80"

[plumsauce]

Originally Posted by James321

Server OS is Windows Server 08, not Linux. And im not running any website, they are Game Servers.

On a Windows Server you do not need wireshark. Use the built in network monitor application. Look at some of the raw data, then build a filter that sifts for the most interesting information.

But really, before trying to find the evidence to fit the case, you should explain why you suspect a denial of service. What makes you suspicious/worried?

[James321]

Originally Posted by Secure_host

in windows server :

go to cmd.exe and then type :

netstat -aon
with this command a show all connection with tcp and upd that listening
n show all conntection with ip and port
o show pid of each connections
netstat -aon|find /c "80"

Im new to this, Can you explain how I can read the data? What each State mean and pid? Thanks!

[david510]

Use the following command to find the connection flood to the port 25 on an IP.

tcpdump -nnqt dst host IP and tcp dst port 25