A DDoS attack coming from your server: finding the outgoing flood and stopping it

Security·· 4 views· 4 min read

This article is for customers with a VPS or a dedicated server, with root access. The short answer: the notice says a flood of packets or connections left your server’s IP towards another address. Our network provider sees that traffic on the network and sends us the notice, with a short deadline, often a single day. There are three usual causes: a bot installed on the server, a service open to the internet being used for reflection (your server answers forged requests and the answers land on the victim), or a program of yours running out of control. While the traffic continues, the server may be switched off and the IP blocked, so the first step is to cut the outgoing flow.

What you see, and what it usually is

What you see What it usually is
Lots of traffic to a single destination, from a process you do not recognise A bot following orders: botnet activity reported from your server.
UDP replies leaving ports 53, 389, 111, 123 or 11211 Reflection: an open service (DNS, CLDAP, Portmapper, NTP, Memcached). See the open DNS resolver and CLDAP, Portmapper and other UDP services.
Mass HTTP requests to one site, from a script or a testing tool A load test or a faulty script. Testing a site that is not yours, without permission, is an attack.
Connections to many different destinations, always on the same port A scan, not a DDoS: your VPS is scanning other networks.

Finding the traffic and stopping it

1 See where the traffic goes. iftop and nethogs may not be installed. The interface name (here eth0) may differ: check it with ip -br link. apt install iftop nethogs # Debian/Ubuntu
dnf install iftop nethogs # AlmaLinux/Rocky, with EPEL
iftop -n -i eth0
nethogs eth0
2 See which process is sending. ss -s
ss -tunap | grep -v 127.0.0.1 | head -50
lsof -i -n -P | grep -i udp
top A process with high CPU and many connections to the same destination is the suspect.
3 If it is reflection, see which service answers to the outside. ss -ulpn
rpcinfo -p A service you do not use can be switched off right away, for example Portmapper: systemctl disable --now rpcbind rpcbind.socket First make sure nothing legitimate depends on it (NFS, for instance, needs it).
4 Cut the outgoing traffic to the target. In the server’s firewall, which only you can change: ufw deny out to TARGET_IP
# or, with nftables and an inet filter table with an output chain:
nft add rule inet filter output ip daddr TARGET_IP drop
5 Stop the source. If it is a bot, keep a copy and end the process, as in cutting off a botnet. If it is a service, close it or limit it to your own network. If it is your own program, stop it and fix it.
6 Check that it stopped. Watch iftop for a few minutes: outgoing traffic should be back to what is normal for your server.
7 Close the door and reply to us. Find out how the bot got in (is my VPS compromised?), update the system (automatic updates), set up the firewall and send the report: writing the reply to an abuse notice.
Blocking the target hides the symptom, it does not fix the cause. A bot gets a new target and the next notice arrives with a different destination. And if the traffic continues past the deadline, the server is switched off to protect the network, without deleting any data: why the server was switched off or locked. On a compromised server, the safest path is to reinstall and restore a clean copy.
If the attack is AGAINST your server, you need a different article: DDoS attack or just a traffic spike. What stays on our side and what is yours is in what we do about security.

Got a DDoS notice and cannot find the traffic? Reply in the same support ticket with the output of the commands above.

Open a support ticket

SEE ALSO

An abuse notice about your server: what it means, the deadline and what we need from you

Botnet or command-and-control activity from your server: cutting it off and cleaning up

CLDAP, Portmapper and other open UDP services: reflection attacks and how to close them

An open DNS resolver on your VPS: why it is used in attacks and how to turn off recursion

Writing the reply to an abuse notice: cause, what you removed and how it will not happen again

DDoS attack or just a traffic spike: how to tell, and what to do

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.59/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 550 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 436 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 998 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 862 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 397 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 3 A fraud complaint about a site on your account: what happens next and what to send us The short answer: a fraud complaint says a site on your account deceives people: a fake cryptocurrency investment promis...