====== Ubuntu - Networking - Finding DDOS attacks ====== Some useful commands to check during DDOS attack. **NOTE:** The **netstat** command has been superseeded by the **ss** command. But if your system is old, and **ss** does not work, then simply use **netstat** in place of **ss**. ---- ===== List the connections to the target IPs ===== ss -alpn | grep :80 | awk '{print $4}' |awk -F: '{print $(NF-1)}' |sort |uniq -c | sort -n returns: 1 511 ---- ===== List connections from source IPs ===== netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort |uniq -c | sort -n returns: 1 1 0.0.0.0 1 123.123.123.123 1 234.234.234.234 ---- ===== See the state of each connection ===== ss -an|grep ":80"|awk '/tcp/ {print $6}'|sort| uniq -c returns: 1 [::]:* 1 0.0.0.0:* 1 123.123.123.123:56360 ---- ===== Identify the attacker ===== tcpdump -c -n -i eth0 -p host IP_Address returns: tcpdump -c 100 -i br0 -p host 192.168.1.2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes 12:39:23.239478 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 829605160:829605348, ack 3653010571, win 62780, length 188 12:39:23.239694 IP peter.sharewiz.net.51864 > server1.sharewiz.net.ssh: Flags [.], ack 188, win 65535, length 0 12:39:23.240455 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 188:488, ack 1, win 62780, length 300 12:39:23.240518 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 488:652, ack 1, win 62780, length 164 12:39:23.240572 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 652:816, ack 1, win 62780, length 164 12:39:23.240645 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 816:980, ack 1, win 62780, length 164 12:39:23.240734 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 980:1144, ack 1, win 62780, length 164 12:39:23.240794 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 1144:1308, ack 1, win 62780, length 164 12:39:23.240821 IP peter.sharewiz.net.51864 > server1.sharewiz.net.ssh: Flags [.], ack 488, win 65535, length 0 12:39:23.240845 IP peter.sharewiz.net.51864 > server1.sharewiz.net.ssh: Flags [.], ack 652, win 65535, length 0 12:39:23.240853 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 1308:1472, ack 1, win 62780, length 164 12:39:23.240862 IP peter.sharewiz.net.51864 > server1.sharewiz.net.ssh: Flags [.], ack 816, win 65535, length 0 12:39:23.240870 IP peter.sharewiz.net.51864 > server1.sharewiz.net.ssh: Flags [.], ack 980, win 65535, length 0 12:39:23.240959 IP server1.sharewiz.net.ssh > peter.sharewiz.net.51864: Flags [P.], seq 1472:1732, ack 1, win 62780, length 260 ... ---- ===== Check if a server is under a DoS attack ===== ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n|wc -l returns: 2 **NOTE:** If the output returns a result like 2000 or 3000 connections!, then it is very likely the server is under a DoS attack. ---- ==== Colourful Output ==== ss -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r | while IFS= read -r line; do if [[ `echo $line | cut -d' ' -f 2` =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo -e "\033[0;31m$line"; else echo -e "\033[0;34m$line"; fi; done returns: 21 192.168.1.69 4 127.0.0.1 2 [fd42 ---- ===== Detect a SYN flood ===== ss -nap | grep SYN | wc -l returns: 0 **NOTE:** If the output returns a high value, say over a thousand, this could mean the server is under attack. This figure will vary depending on usage of the server. A system may intentionally have many thousand users, so a high value here does not always mean there is an SYN Flooding attack. ---- ===== Check for a UDP Denial of Service ===== ss -nap | grep 'udp' | awk '{print $5}' | cut -d: -f1 | sort |uniq -c |sort -n returns: 1 0.0.0.0%virbr0 1 127.0.0.1 1 127.0.0.53%lo 2 0.0.0.0 2 172.17.255.255 2 192.168.0.255 2 192.168.123.255 2 192.168.1.255 3 172.17.0.1 3 192.168.0.2 4 192.168.123.1 13 192.168.1.2 **NOTE:** The above command will list information concerning possible UDP DoS. The command can easily be accustomed also to check for both possible TCP and UDP denial of service, like so : ss -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n returns: 1 * 1 0.0.0.0%virbr0 2 127.0.0.53%lo 2 172.17.255.255 2 192.168.0.255 2 192.168.123.255 2 192.168.1.255 4 172.17.0.1 4 192.168.0.2 5 [ 5 192.168.123.1 9 127.0.0.1 12 0.0.0.0 23 192.168.1.2 **NOTE:** If a specific IP has too many connections to the server; it is almost certainly a DoS host; so suggestion is to filter this IP. ---- ===== Remove hosts to not be able to route packets to the server ===== ip route add blackhole 123.123.123.123. or route add 123.123.123.123 reject The above command would null route the access of IP 123.123.123.123 to my server. To check the routing for this IP is null: ip route |grep -i 123.123.123.123 ---- ===== Useful commands ===== 1. tcpdump -i igb1 -nnn -c 10 dst port 80 host This is for freebsd cmd where "igb1" is the netwok interface name 2. time tcpdump -i igb1 -nnn -c 1000 dst port 80 host 192.168.0.5 | tail 3. tail -1000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -b -k1 -n | tail 4. netstat -n | awk '{ print $5 }' | cut -d ":" -f 1 | grep "[1-9]" | sort | uniq -c | sort -n 5. awk '{print $5}' /proc/net/ip_conntrack|sort |uniq -c |sort -rn |head -25 | column -t 6. netstat -nt | grep :80 | wc -l 7. tcpdump -A dst 192.168.1.14 -s 500 | grep -i refer 8. tcpdump -i eth0 -vvv -nn -s 1700 -w ddos tcpdump -nn -vv -r ddos | awk '{print $18}' | awk -F\. '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -rn | head -25 9. /usr/local/apache/bin/apachectl fullstatus