09. July 2010 · 2 comments · Categories: Linux

A quick and useful command for checking if a server is under ddos:


netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n


That will list the IPs taking the most amounts of connections to a server. It is important to remember that ddos is becoming more sophisticated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.

Another very important thing to look at is how many active connections your server is currently processing.


netstat -n | grep :80 |wc -l

netstat -n | grep :80 | grep SYN |wc -l


The first command will show the number of active connections that are open to your server. Many of the attacks typically seen work by starting a connection to the server and then not sending any reply making the server wait for it to time out. The number of active connections from the first command is going to vary widely but if you are much above 500 you are probably having problems. If the second command is over 100 you are having trouble with a syn attack.

To Block a certain IP address that on server .Please use following commands:


route add ipaddress reject


… for example: route add 192.168.0.168 reject

You can check whether given IP is blocked on server by using following command


route -n |grep IPaddress


Or use follwoing command to block a ip with iptables on server


iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT

service iptables restart

service iptables save


Then KILL all httpd connection and restarted httpd service by using following command:


killall -KILL httpd

service httpd startssl


A simple command such as netstat -n -p|grep SYN_REC | wc -l would list all the active SYN_REC connections on the server… depending on the server’s size, 30 to 40 SYN_REC could be a sign of a DDOS attack.

Again, do not be fixed on numbers, different variant play when deciding to ring the DDOS emergency bell


netstat -n -p | grep SYN_REC | awk ‘{print $5}’ | awk -F: ‘{print $1}’ will therefore list all the IPs that are maintaining the SYN_REC connections.

A quick and useful command for checking if a server is under ddos:

netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

That will list the IPs taking the most amounts of connections to a server. It is important to remember that ddos is becoming more sophisticated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.

Another very important thing to look at is how many active connections your server is currently processing.

netstat -n | grep :80 |wc -l

netstat -n | grep :80 | grep SYN |wc -l

The first command will show the number of active connections that are open to your server. Many of the attacks typically seen work by starting a connection to the server and then not sending any reply making the server wait for it to time out. The number of active connections from the first command is going to vary widely but if you are much above 500 you are probably having problems. If the second command is over 100 you are having trouble with a syn attack.

To Block a certain IP address that on server .Please use following commands:

route add ipaddress reject

… for example: route add 192.168.0.168 reject

You can check whether given IP is blocked on server by using following command

route -n |grep IPaddress

Or use follwoing command to block a ip with iptables on server

iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT

service iptables restart

service iptables save

Then KILL all httpd connection and restarted httpd service by using following command

killall -KILL httpd

service httpd startssl

A simple command such as netstat -n -p|grep SYN_REC | wc -l would list all the active SYN_REC connections on the server… depending on the server’s size, 30 to 40 SYN_REC could be a sign of a DDOS attack.

Again, do not be fixed on numbers, different variant play when deciding to ring the DDOS emergency bell

netstat -n -p | grep SYN_REC | awk ‘{print $5}’ | awk -F: ‘{print $1}’ will therefore list all the IPs that are maintaining the SYN_REC connections.

2 Comments

  1. Hello This is a great blog keep your good work and thank you for hvar in with me So nice to hear frome you.Thanks!

  2. Thanks a lot Rachel for your consideration …

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

css.php