holders) the service or resource they expected.
Victims of DoS attacks often target the web servers of high-profile organizations such as banking, commerce, and media companies, or government and trade organizations. Though DoS attacks do not typically result in the theft or loss of significant information or other assets, they can cost the victim a great deal of time and money to handle.
The difference between DoS and DDoS (Distributed Denial of Service) is in the number of machines (PC, server, mobile, in general, any device connected to the Internet that has been compromised) used to launch the attack, in the case of a denial of the ‘attack takes place from a single machine, while in the far more difficult to block the DDoS attack can take place simultaneously from hundreds of different machines.How can so imagine all the advice in this article do not ensure you total protection against DDoS, because when they are well organized and the attack comes from a large number of different machines, the only way to try to block it or more realistically , mitigate it, is to act upstream, directly on the infrastructure of your provider (which then must contact), unless you have your own network infrastructure.In this article we will see then how to prevent the boy on duty without a social life will block some services on the server showering them with requests thanks to some little program downloaded from an unknown site.
How to recognize an attack?This is definitely the first thing to learn, learn to recognize a DoS attack, I have seen many times blame suffered an attack of this type just the services hosted on the servers are unreachable, even though the more likely things are very different.First, if you are under attack, you will see a spike (which can vary from a few to several Mbit / s) in your graphics bandwidth used, and a peak in the connections netstat, for this would be good to generate graphs of all the most important services on your server.Once satisfied that there are anomalous peaks in the use of bandwidth, use this command to display the status of all active connections on your server:netstat -nat | awk ‘{print $ 6}’ | sort | uniq -c | sort -n
The output will be something like:
1 CLOSING
Established 1)
1 Foreign
5 LAST_ACK
15 FIN_WAIT1
16 LISTEN
59 FIN_WAIT2
424 TIME_WAIT
442 ESTABLISHED
If you notice that there are several connections in state SYS_SENT‘re definitely under attack, at this point you just have to find the IP or IP addresses from which come more connections, you can do it with this command:
netstat -atun | awk ‘{print $ 5}’ | cut -d: -f1 | sed -e ‘/ ^ $ / d’ | sort | uniq -c | sort -n
At this point you will have a list sorted by number of open connections from any IP in the end most likely you will have the IP of the machine from which they are attacking you, now you just have to block these IP, as we shall see in the next chapter.
Another very useful utility for analyzing network traffic and see it in real time is tcptrack, once installed use the following commands to start the monitoring:
tcptrack -i eth0 will show you all traffic on port 80
tcptrack -i eth0 src or dst 127.0.0.1 will show you all the traffic generated by the IP address specified.
In most tcptrack mosterà you real-time bandwidth usage.
What is Hacking?
Hacking is a drawback of internet technology.Suppose you have a big House,there are various way to enter into the house.Finally you secure all the way that unauthorized people cannot enter to the house. But some unauthorized people try to enter to the house and finally they or any of them enter to the house successfully.This unauthorized people is called hacker and the procedure which is applied to enter to the house is called hacking.Similarly your server(data server) is your house and all the protocols or ports are the way to hack your server(computer).
If you want to go to a safe place then you have to disconnected from internet system. Actually in the world two types of hacker "white hat" and "black hat" hacker.White hackers are legal hacker but black hat hacker always want to stole something.
If you want to be an hacker you have to choose any of them. But firstly you have to learn about basic level of hacking called Ethical Hacking. Because some information or some knowledge which will help you to start hacking. Some basic information are know about "IP address","port","protocol","database","server" etc.There is a community, a shared culture, of expert programmers and networking wizards that traces its history back through decades to the first time-sharing minicomputers and the earliest ARPAnet experiments. The members of this culture originated the term ‘hacker’. Hackers built the Internet. Hackers made the Unix operating system what it is today. Hackers make the World Wide Web work. If you are part of this culture, if you have contributed to it and other
people in it know who you are and call you a hacker, you're a hacker.
The hacker mind-set is not confined to this software-hacker culture. There are people who apply the hacker attitude to other things, like electronics or music — actually, you can find it at the highest levels of any science or art. Software hackers recognize these kindred spirits elsewhere and may call them ‘hackers’ too — and some claim that the hacker nature is really independent of the particular medium the hacker works in. But in the rest of this document we will focus on the skills and attitudes of software hackers, and the traditions of the shared culture that originated the term ‘hacker’. There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them.
Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end. The basic difference is this: hackers build things, crackers break them.
