My server got 13 gbit ddos so leasweb nulled ip and the attack ended. My ip is still blocked and i got temp second ip. It is still not public.
Now my question is how can i detect the attack from logs ?
windows server 2008 r2
closed as not a real question by Oliver Salzburg♦ Aug 5 '12 at 23:23
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.
I have some doubts you can read anything from logs. The DDoS means someone has instructed a lot of machines, usually Windows machines infected by malware forming a botnet to issue bogus requests against your IP. You would get those IPs (belonging to morons, but innocent morons) and not for long cos you were null routed and so no traffic reached the machine.