Are You Under a DoS Attack? Here's How to Tell

Denial of Service attacks are difficult to mitigate, since they usually disguise themselves as normal connections and traffic, but in abundant quantities, until the server runs out of resources to process requests and the service becomes unavailable.

One way to check if there are too many connections and where they're coming from is with the netstat command.

The simplest way is to list connections with the netstat -an command

$ netstat -an

Conexões Internet Ativas (servidores e estabelecidas)

Proto Recv-Q Send-Q Local Address               Foreign Address             State      

cp        0      0 0.0.0.0:11211               0.0.0.0:*                   OUÇA       

tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   OUÇA       

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   OUÇA       

tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   OUÇA       

tcp        0      0 127.0.0.1:11211             127.0.0.1:51898             ESTABELECIDA

tcp        0      0 127.0.0.1:11211             127.0.0.1:51570             ESTABELECIDA

tcp        0      0 127.0.0.1:11211             127.0.0.1:53800             ESTABELECIDA

tcp        0      0 127.0.0.1:53800             127.0.0.1:11211             ESTABELECIDA

tcp        0      0 127.0.0.1:11211             127.0.0.1:52002             ESTABELECIDA

But this is hard to count, since denial of service attack connections are fast.

A viable option, still using the netstat command, is:

$ netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

     34 127.0.0.1

      1 50.31.164.148

      1 50.31.164.147

      1 50.31.164.146

      1 35.155.143.94

      1 10.8.0.6

This way, this command will count established connections by source IP address.

You can also modify the command above, to list for example only connections on port 80:

$ netstat -lan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

      1 0.0.0.0

      1 169.254.169.254

      2 127.0.0.1

     64 149.56.180.254

In this example, this server is under a SYN_SENT attack, coming from IP 149.56.180.254 with 64 connections, which can be confirmed through netstat:

netstat -an|grep 149.56.180.254

tcp        0      0 172.30.1.187:80             149.56.180.254:38165        SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:5557         SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:3605         SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:18728        SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:35138        SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:23965        SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:41358        SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:44263        SYN_RECV    

tcp        0      0 172.30.1.187:80             149.56.180.254:52759        SYN_RECV   

In this case, we can raise an IPTABLES rule to DROP all connections coming from this address:

# iptables -I INPUT -s 149.56.180.254 -j DROP

Running netstat again we can see that the SYN connection requests are gone:

# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

      1 0.0.0.0

      1 169.254.169.254

      2 127.0.0.1

Did you like this post? Check out the Firewall Iptables course and the Pfsense online training, from Certificação Linux

Learn much more about Linux in our online course. You can enroll here with a 7-day free trial. If you already have an account, you can access here.

Liked it? Share :-)