Web server outages and DDOS attacks

Forums › IT Pro and developers › Web server outages and DDOS attacks - how common are they?

RobinmNZ

24 posts

Geek

#189614 6-Jan-2016 13:00

We have a dedicated server based in the US and are having huge problems with outages - pretty much every morning around 3am it is out for 30 mins to an hour, and often again at other times during the day and night.
These appear to be attacks on one or two of the bigger sites on our server (both of which are news sites, not retail or forums).
These outages bring down all the other sites on the server.
Our server people are forever blocking IPs and countries from the firewall.
Is this a common problem?
The server folks always come back with techie explanations but it keeps on happening, which makes me wonder if there is a problem with the server setup - but I don't know enough about it to question things.
The reason we are on a dedicated server (about 4 years and not cheap) was because we were having outages because other sites on a shared server were bringing the whole thing down.

I am looking to move to another server - however will these problems come with me?

The CMS software on the main target sites is kept up to date.

Has anyone out there had a similar problem? Is there a solution that won't cost a bomb?

1 | 2 | 3 | 4

19282 posts

Uber Geek
Inactive user

#1462281 6-Jan-2016 13:11

Is there a pattern to the county IPs? See about blocking a range instead of single IP

mattwnz

20164 posts

Uber Geek

#1462284 6-Jan-2016 13:16

Get a new provider. It is not normal. Even on shared hosting it isn't normal, unless you are using cheap ones.

timmmay

20581 posts

Uber Geek

Trusted

Lifetime subscriber

#1462285 6-Jan-2016 13:17

Nope, not common. My shared host is up 99.8% every month, usually 100%. That's $13/month but support is awful.

I'm moving my sites to Amazon AWS right now. Their servers will be reliable, and you can architect for reliability to whatever level you like:
- Geographic redundency, with app servers and database servers in multiple data centers or countries
- Same data center or group of data centres, load balanced across them. You can get multiple smaller servers instead of one larger server if you do this or the option above.
- Or just a single server

Andib

1364 posts

Uber Geek

ID Verified

Trusted

#1462287 6-Jan-2016 13:18

Are there any game servers being run off your server?

Other possibility is a compromised website (unpatched wordpress) that is bringing in / sending out traffic.

<#
.DISCLAIMER
Anything I post is my own and not the views of my past/present/future employer.
#>

RobinmNZ

24 posts

Geek

#1462317 6-Jan-2016 13:43

Andib: Are there any game servers being run off your server?

Other possibility is a compromised website (unpatched wordpress) that is bringing in / sending out traffic.

No, no gaming stuff there. We do also keep the WP sites updated.
thanks.

RobinmNZ

24 posts

Geek

#1462318 6-Jan-2016 13:44

johnr: Is there a pattern to the county IPs? See about blocking a range instead of single IP

Apparently this morning Bulgaria and Romania were blocked completely, China is already blocked. They do block out ranges of numbers, at least that is what I am told. I do have access to the WHM but I know enough to be dangerous in there so are very careful.

RobinmNZ

24 posts

Geek

#1462322 6-Jan-2016 13:46

mattwnz: Get a new provider. It is not normal. Even on shared hosting it isn't normal, unless you are using cheap ones.

I don't think what we have is a cheap one: here are the specs - that is the per month price, it was $260 but there was a reducing 2 months ago.

Intel Xeon 5430 Single Processor, Quad Core - (01/26/2016 - 02/25/2016) $231.00 USD
cPanel/WHM: Yes
Additional drive: Yes
Additional RAM: No
Additional RAM: Yes
Backup service (requires backup drive above): Yes
Enhanced monitoring package: Yes
Fantastico: No
------------------------------------------------------
Sub Total: $231.00 USD

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

RobinmNZ

24 posts

Geek

#1462325 6-Jan-2016 13:52

timmmay: Nope, not common. My shared host is up 99.8% every month, usually 100%. That's $13/month but support is awful.

I'm moving my sites to Amazon AWS right now. Their servers will be reliable, and you can architect for reliability to whatever level you like:

Wow - I haven't calculated our uptime (on a monthly basis) but it can't be anywhere near that.

I will say, for our $US231 /month, the support is pretty good - at least we do get a response reasonably quickly most of the time. All ticket based, though, so there is no-one to phone up.

I have been exploring other hosts but am going to need help to move the WP sites over to a new server .. not looking forward to it. One crowd told me the site/s could be down for up to 24 hours, which is not really acceptable.

Thanks for all your support, folks, I don't feel so alone now!!

timmmay

20581 posts

Uber Geek

Trusted

Lifetime subscriber

#1462329 6-Jan-2016 13:58

Amazon m4.xlarge is US$1200 per year on a one year term, double that to double the specs. It's not dedicated but it's 4 core 16GB RAM. No support as such, if it breaks you fix it. May be some extra charges like traffic, backups, etc.

RobinmNZ

24 posts

Geek

#1462330 6-Jan-2016 14:01

timmmay: Amazon m4.xlarge is US$1200 per year on a one year term, double that to double the specs. It's not dedicated but it's 4 core 16GB RAM. No support as such, if it breaks you fix it. May be some extra charges like traffic, backups, etc.

Thanks - the pricing seems OK compared with what I have now, but does that mean if there is a hacker or DDOS attack I have to fix it? I am afraid that would be beyond me ...

timmmay

20581 posts

Uber Geek

Trusted

Lifetime subscriber

#1462333 6-Jan-2016 14:05

RobinmNZ:
timmmay: Amazon m4.xlarge is US$1200 per year on a one year term, double that to double the specs. It's not dedicated but it's 4 core 16GB RAM. No support as such, if it breaks you fix it. May be some extra charges like traffic, backups, etc.

Thanks - the pricing seems OK compared with what I have now, but does that mean if there is a hacker or DDOS attack I have to fix it? I am afraid that would be beyond me ...

It means there's no-one to call and say "hey my website is down" or "my site has been hacked". You have full control, you fix it yourself. However Amazon will deal with DDOS type stuff.

If you need that you need to use a provider for support. You'd just need a better provider than the one you have now.

marpada

476 posts

Ultimate Geek

#1462336 6-Jan-2016 14:10

You didn't mention the nature of the attack, but one common problem with big sites is bots aggressively crawling the content, both bona-fide or rogue bots (which don't honour robots.txt). In all cases I was able to parry them by blocking dodgy User-Agents or through webserver modules to limit the request rate (http://nginx.org/en/docs/http/ngx_http_limit_req_module.html). If using Apache you want to check whether is has been tuned properly according to the server specs.

Using Cloudfare is usually also an easy win.

RobinmNZ

24 posts

Geek

#1462337 6-Jan-2016 14:10

Thanks, I am looking at the Amazon site and videos now.

I think I need to contact someone there for some answers as to how it could work for me - I have no idea of what 'services' I would need. Watching a webinar now.
As for fixing stuff, sheesh.

This has all made me determined to move on from our existing host - fun times ahead!

timmmay

20581 posts

Uber Geek

Trusted

Lifetime subscriber

#1462342 6-Jan-2016 14:16

Look at it this way: with Amazon you get a server (Linux or Windows) that you 100% manage, but they worry about power, network, etc. If you or someone in your organisation isn't comfortable configuring servers from scratch and maintaining them AWS isn't for you, you may need a supported solution. For example they won't know or care if your website goes down, that's your problem, you fix it. If you want someone to monitor and fix things like that, use a supported host.

AWS rents out VMs, is the most basic way to look at it. They have way more services, but that's the basics.

Putting CloudFlare in front of a domain is often a good idea. Business plans give you more flexibility and aren't that expensive. Free plans are fine for many.

RobinmNZ

24 posts

Geek

#1462349 6-Jan-2016 14:33

timmmay: Look at it this way: with Amazon you get a server (Linux or Windows) that you 100% manage, but they worry about power, network, etc. If you or someone in your organisation isn't comfortable configuring servers from scratch and maintaining them AWS isn't for you, you may need a supported solution. For example they won't know or care if your website goes down, that's your problem, you fix it. If you want someone to monitor and fix things like that, use a supported host.

AWS rents out VMs, is the most basic way to look at it. They have way more services, but that's the basics.

Putting CloudFlare in front of a domain is often a good idea. Business plans give you more flexibility and aren't that expensive. Free plans are fine for many.

Thanks, yes, I think Amazon AWS may be a little beyond me. I'm giving CloudFlare a try with another site so will see how that goes.

However we still need to change hosts - and recommendations from anyone re hosting providers - NZ or otherwise?

Our main website gets about 250,000 unique visitors a month.

1 | 2 | 3 | 4