Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My server got a 13 GBit DDoS attack so LeaseWeb nulled its IP address and the attack ended. My IP address is still blocked. I got a temporary second IP address, which is not yet public.

How can I detect the attack from my logs?

My server runs Windows Server 2008 R2.

share|improve this question

closed as not a real question by Oliver Salzburg Aug 5 '12 at 23:23

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 1 down vote accepted

I have some doubts you can read anything from logs. The DDoS means that someone instructed a lot of machines, usually Windows machines infected by malware forming a botnet, to issue bogus requests against your IP. You would get those IPs (belonging to morons, but innocent morons) and not for long (because you were null routed so no traffic reached the machine).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.