Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




41 posts

Geek
+1 received by user: 5


Topic # 136515 29-Nov-2013 18:56
Send private message

Hi,

I know it's Friday night but I'm in a real pickle:

I'm a small time web developer hosting about 20 sites on a Net24 VPS (Centos/Plesk). The largest of these is for a charitable organisation I'm connected with (webmaster and former cuncil member) - Permaculture in New Zealand Inc. It's a Drupal 7 site.
Typically for a NZ-based VPS, it has unlimited NZ traffic and 15GB/m International traffic, which has been fine until recently.

We've had a longstanding problem with bots trying to sign up for the site (although even when they were getting in, most never posted any spam). The BOTCHA module (a honeypot) now manages to keep our database unsullied, but of course that still results in two full pages being served for each attempt.

I was belatedly alerted (by way of unpaid additional invoices that I didn't notice arrive) to the fact that International Traffic has crept, then soared over the server limit. Currently approaching 50GB/month. It's all hitting the permaculture site. There seem to be requests for a wide range of resources - even the 404s are over 10GB worth. Outbound is heavily exceeding inbound.

While there is an independent traffic monitoring system which gives some real-time information, neither the Virtual container nor Plesk seem to be able to distinguish between local and overseas traffic. 

I have now suspended the site while I seek a solution.

Although I've worked for a hosting company in the past, I'm not a sysadmin, and am thoroughly out of my depth.

Does anyone feel like lending a helping hand, pro-bono?

 skype is dramatic_design

Filter this topic showing only the reply marked as answer Create new topic
14648 posts

Uber Geek
+1 received by user: 2724

Trusted
Subscriber

  Reply # 943090 29-Nov-2013 19:06
3 people support this post
Send private message

Can you ask the hosting company to block the requests somehow? Are they from a subset of IPs or random?

Sign up for cloudflare, a free CDN/protection service that should block a lot of the requests for you. I use it, so does geekzone.

 
 
 
 


6857 posts

Uber Geek
+1 received by user: 2293
Inactive user


  Reply # 943191 29-Nov-2013 22:27
Send private message

I have a few nodes in the states on 1Gbp/s WAN connections without DDOS protection. Have a CPanel on it for minecraft hosting and some mates just use it. On average i use over 15Tb a month just from DDOS. Ill attach an email for a DDOS mitigation.


Hello Tim,

This is a courtesy notification regarding your server. Our network monitoring systems detected an incoming attack against your server, and for your protection we have automatically begun filtering this traffic. Please note there has been no downtime or service interruption as a result of this attack, and there is nothing further that you will need to do to respond to this incident. As this attack originated from a spoofed address, we are unable to determine its source at this time.

You may review the details of the attack below:

Target IP(s): 8.24.159.60
Attack Start: 2013-01-18_04:48:42
Attack Size: 6.96_Gbps
Attack Type: UDP_Misuse_

If you have any questions or concerns, please feel free to contact us.

Thank you,

The Secured Servers Support Team



41 posts

Geek
+1 received by user: 5


  Reply # 943229 29-Nov-2013 22:57
Send private message

timmmay: Can you ask the hosting company to block the requests somehow? Are they from a subset of IPs or random?


random IPs, but several I've checked are blacklisted. Being a VPS, the hosts offer no support (or $60 a request).

Sign up for cloudflare, a free CDN/protection service that should block a lot of the requests for you. I use it, so does geekzone.


Thanks, I hadn't heard of them - just waiting for DNS to change over. Nice business model - charge the corporates enough that they can serve smaller sites for nix.

BDFL - Memuneh
63040 posts

Uber Geek
+1 received by user: 13612

Administrator
Trusted
Geekzone
Lifetime subscriber

1332 posts

Uber Geek
+1 received by user: 152
Inactive user


  Reply # 943261 30-Nov-2013 00:43
Send private message

I find using one of the larger hosting providers removes this issue entirely. Someone like Dreamhost, GoDaddy, 1and1 and so forth. All of them offer plans suitable for the kind of site you run and most of them have unlimited resources available.



41 posts

Geek
+1 received by user: 5


  Reply # 947031 7-Dec-2013 12:18
Send private message

We are now running under the cap, although direct International traffic is still outweighing local.
With a new billing month I've managed to set caps that will prevent or at least warn of excess.
I need to do some work on sitemaps to make crawlers more economical, and I'm looking at putting some of the other sites on Cloudflare.

BDFL - Memuneh
63040 posts

Uber Geek
+1 received by user: 13612

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 947034 7-Dec-2013 12:29
Send private message

And are you sure you don't have any service exposed to the world - SMTP, FTP, DNS that shouldn't be open wide? Is this HTTP/HTTPS only?






41 posts

Geek
+1 received by user: 5


  Reply # 947035 7-Dec-2013 12:38
Send private message

Fairly confident - during the problem period, 99%+ of traffic was HTTP
- I don't run email on myserver other than sites sending directly, as my experience with a hosting company showed that 80% of servers falling over were caused by mail processing loads
- I don't think there's anything pointing at the server as a Nameserver
- On the contrary, outbound FTP actually seems to be blocked - things like Wordpress updates aren't working. This might be because I activated the container firewall but it isn't working as advertised and fails to change settings. I suspect that it's just non-cacheable pages.

4025 posts

Uber Geek
+1 received by user: 1076

Trusted

  Reply # 947084 7-Dec-2013 14:20
Send private message

Are you using something like fail2ban to match patterns? Repeated 404's from the same IPs over and over should be fairly easy to match and ban.
Also reduce the size of your error pages if they have images or any other fancy stuff.

Filter this topic showing only the reply marked as answer Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

NZ and France seek to end use of social media for acts of terrorism
Posted 24-Apr-2019 12:13


Intel introduces the 9th Gen Intel Core mobile processors
Posted 24-Apr-2019 12:03


Spark partners with OPPO to bring new AX5s smartphone to New Zealand
Posted 24-Apr-2019 09:54


Orcon announces new always-on internet service for Small Business
Posted 18-Apr-2019 10:19


Spark Sport prices for Rugby World Cup 2019 announced
Posted 16-Apr-2019 07:58


2degrees launches new unlimited mobile plan
Posted 15-Apr-2019 09:35


Redgate brings together major industry speakers for SQL in the City Summits
Posted 13-Apr-2019 12:35


Exported honey authenticated on Blockchain
Posted 10-Apr-2019 21:19


HPE and Nutanix partner to deliver hybrid cloud as a service
Posted 10-Apr-2019 21:12


Southern Cross and ASN sign contract for Southern Cross NEXT
Posted 10-Apr-2019 21:09


Data security top New Zealand consumer priority when choosing a bank
Posted 10-Apr-2019 21:07


Samsung announces first 8K screens to hit New Zealand
Posted 10-Apr-2019 21:03


New cyber-protection and insurance product for businesses launched in APAC
Posted 10-Apr-2019 20:59


Kiwis ensure streaming is never interrupted by opting for uncapped broadband plans
Posted 7-Apr-2019 09:05


DHL Express introduces new MyDHL+ online portal to make shipping easier
Posted 7-Apr-2019 08:51



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.