Re: How to block a ddos attack?

On Mon, 2008-10-06 at 23:18 +0200, Jimmy Spam wrote:

Without knowing a lot about your setup, could you use the tcpserver
patch which allows limiting of the number of connections per ip? It may
be a way to alleviate the pain a bit.

Good luck.

Shane

> The kind of this attack is open multiple smtp sessions for send spam to
> local domains from thousand of different ip's.
> 
> I can't block any port because I need keep on the smtp service. I have
> blocked many bad ip's, but it's useless, thousand of new ip's continue
> connecting to my server each day...
> 
> I think that even if I was able to close connections in real time, my
> server was also overload, because the socket takes some time to be
> completely closed and available for new connections.
> 
> I'm fucked. :-(
> 
> > Without knowing the kind of ddos attack there is no way to fight against
> > it.
> > Please check your logs to find out on which port(s) the attack was.
> >
> > I use fail2ban script to block password bruteforce attacks.
> >
> > Best regards
> > Christoph
> >
> > Jimmy Spam schrieb:
> >> Hi friends,
> >>
> >> I'm suffering a DDoS attack since some days ago. I'm becoming mad!!, I
> >> can't block it. Block by ip is useless.
> >>
> >> bastards spammers of hell...!!
> >>
> >>
> >>
> >> ______________________________________________________________________
> >> Correo gratis de Pobladores.com
> >> Ahora con 25MB de capacidad.
> >> http://www.pobladores.com/services/webmail
> >>
> >
> >
> 
> 
> 
> ______________________________________________________________________
> Correo gratis de Pobladores.com
> Ahora con 25MB de capacidad. 
> http://www.pobladores.com/services/webmail