Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've tried tcpflow and iptables but I'm unable to do so.

I believe someone is attempting to DDOS my open port which is a server, so that my clients are unable to connect. From tcpflow I'm able to get the data which is transmitted and it seems to be simply spam. I want to find the IP address that's doing this so that I may block it.

I've tried:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 

This shows me the IP and number of connections, but I'm still unable to find what I need.

share|improve this question
1  
If somebody is performing a DDOS attack against you, the last thing you want to do, is record junk data and fill up your system disk with garbage. Have you talked to your hosting provider on ways to midigate the damage? –  Ramhound Jul 10 '13 at 10:45
    
If some one is DDOSing you you won't find an IP address, you will find hundreds. That is the definition of Distributed Denial of Service. Like @Ramhound said - make sure you talk to your ISP to mitigate the damage. –  prateek61 Jul 10 '13 at 12:06
    
actually they are flooding my port say like 7887 and server is too busy replying them, is there any way i can restrict number of incoming request on port 7887/tcp , like 4 request per second –  GangsTaRun Jul 10 '13 at 13:47
    
@GangsTaRun - Have you talked to your provider? They have the ability to do what you want, DDOS based protection software, is not very effective. It does exist, it just functions in a way, where it wouldn't create multiple sessions for the same ip address. –  Ramhound Jul 10 '13 at 15:53
add comment

1 Answer

Try something like this:

iptables -A INPUT -p tcp --dport 7887 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT

...and read Prevent DOS with iptables for more details

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.