Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




41 posts

Geek
+1 received by user: 5


# 136515 29-Nov-2013 18:56
Send private message

Hi,

I know it's Friday night but I'm in a real pickle:

I'm a small time web developer hosting about 20 sites on a Net24 VPS (Centos/Plesk). The largest of these is for a charitable organisation I'm connected with (webmaster and former cuncil member) - Permaculture in New Zealand Inc. It's a Drupal 7 site.
Typically for a NZ-based VPS, it has unlimited NZ traffic and 15GB/m International traffic, which has been fine until recently.

We've had a longstanding problem with bots trying to sign up for the site (although even when they were getting in, most never posted any spam). The BOTCHA module (a honeypot) now manages to keep our database unsullied, but of course that still results in two full pages being served for each attempt.

I was belatedly alerted (by way of unpaid additional invoices that I didn't notice arrive) to the fact that International Traffic has crept, then soared over the server limit. Currently approaching 50GB/month. It's all hitting the permaculture site. There seem to be requests for a wide range of resources - even the 404s are over 10GB worth. Outbound is heavily exceeding inbound.

While there is an independent traffic monitoring system which gives some real-time information, neither the Virtual container nor Plesk seem to be able to distinguish between local and overseas traffic. 

I have now suspended the site while I seek a solution.

Although I've worked for a hosting company in the past, I'm not a sysadmin, and am thoroughly out of my depth.

Does anyone feel like lending a helping hand, pro-bono?

 skype is dramatic_design

Filter this topic showing only the reply marked as answer Create new topic
14744 posts

Uber Geek
+1 received by user: 2746

Trusted
Subscriber

  # 943090 29-Nov-2013 19:06
3 people support this post
Send private message

Can you ask the hosting company to block the requests somehow? Are they from a subset of IPs or random?

Sign up for cloudflare, a free CDN/protection service that should block a lot of the requests for you. I use it, so does geekzone.

 
 
 
 


6615 posts

Uber Geek
+1 received by user: 2293
Inactive user


  # 943191 29-Nov-2013 22:27
Send private message

I have a few nodes in the states on 1Gbp/s WAN connections without DDOS protection. Have a CPanel on it for minecraft hosting and some mates just use it. On average i use over 15Tb a month just from DDOS. Ill attach an email for a DDOS mitigation.


Hello Tim,

This is a courtesy notification regarding your server. Our network monitoring systems detected an incoming attack against your server, and for your protection we have automatically begun filtering this traffic. Please note there has been no downtime or service interruption as a result of this attack, and there is nothing further that you will need to do to respond to this incident. As this attack originated from a spoofed address, we are unable to determine its source at this time.

You may review the details of the attack below:

Target IP(s): 8.24.159.60
Attack Start: 2013-01-18_04:48:42
Attack Size: 6.96_Gbps
Attack Type: UDP_Misuse_

If you have any questions or concerns, please feel free to contact us.

Thank you,

The Secured Servers Support Team



41 posts

Geek
+1 received by user: 5


  # 943229 29-Nov-2013 22:57
Send private message

timmmay: Can you ask the hosting company to block the requests somehow? Are they from a subset of IPs or random?


random IPs, but several I've checked are blacklisted. Being a VPS, the hosts offer no support (or $60 a request).

Sign up for cloudflare, a free CDN/protection service that should block a lot of the requests for you. I use it, so does geekzone.


Thanks, I hadn't heard of them - just waiting for DNS to change over. Nice business model - charge the corporates enough that they can serve smaller sites for nix.

BDFL - Memuneh
63305 posts

Uber Geek
+1 received by user: 13843

Administrator
Trusted
Geekzone
Lifetime subscriber

1332 posts

Uber Geek
+1 received by user: 152
Inactive user


  # 943261 30-Nov-2013 00:43
Send private message

I find using one of the larger hosting providers removes this issue entirely. Someone like Dreamhost, GoDaddy, 1and1 and so forth. All of them offer plans suitable for the kind of site you run and most of them have unlimited resources available.



41 posts

Geek
+1 received by user: 5


  # 947031 7-Dec-2013 12:18
Send private message

We are now running under the cap, although direct International traffic is still outweighing local.
With a new billing month I've managed to set caps that will prevent or at least warn of excess.
I need to do some work on sitemaps to make crawlers more economical, and I'm looking at putting some of the other sites on Cloudflare.

BDFL - Memuneh
63305 posts

Uber Geek
+1 received by user: 13843

Administrator
Trusted
Geekzone
Lifetime subscriber

  # 947034 7-Dec-2013 12:29
Send private message

And are you sure you don't have any service exposed to the world - SMTP, FTP, DNS that shouldn't be open wide? Is this HTTP/HTTPS only?






41 posts

Geek
+1 received by user: 5


  # 947035 7-Dec-2013 12:38
Send private message

Fairly confident - during the problem period, 99%+ of traffic was HTTP
- I don't run email on myserver other than sites sending directly, as my experience with a hosting company showed that 80% of servers falling over were caused by mail processing loads
- I don't think there's anything pointing at the server as a Nameserver
- On the contrary, outbound FTP actually seems to be blocked - things like Wordpress updates aren't working. This might be because I activated the container firewall but it isn't working as advertised and fails to change settings. I suspect that it's just non-cacheable pages.

4025 posts

Uber Geek
+1 received by user: 1076

Trusted

  # 947084 7-Dec-2013 14:20
Send private message

Are you using something like fail2ban to match patterns? Repeated 404's from the same IPs over and over should be fairly easy to match and ban.
Also reduce the size of your error pages if they have images or any other fancy stuff.

Filter this topic showing only the reply marked as answer Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

HPE to acquire supercomputing leader Cray
Posted 20-May-2019 11:07


Techweek starting around NZ today
Posted 20-May-2019 09:52


Porirua City Council first to adopt new council software solution Datascape
Posted 15-May-2019 12:00


New survey provides insight into schools' technology challenges and plans
Posted 15-May-2019 09:30


Apple Music now available on Alexa devices in Australia and New Zealand
Posted 15-May-2019 09:11


Make a stand against cyberbullying this Pink Shirt Day
Posted 14-May-2019 20:23


Samsung first TV manufacturer to launch the Apple TV App and Airplay 2
Posted 14-May-2019 20:11


Vodafone New Zealand sold
Posted 14-May-2019 07:25


Kordia boosts cloud performance with locally-hosted Microsoft Azure ExpressRoute
Posted 8-May-2019 10:25


Microsoft Azure ExpressRoute in New Zealand opens up faster, more secure internet for Kiwi businesses
Posted 8-May-2019 09:39


Vocus Communications to deliver Microsoft Azure Cloud Solutions through Azure ExpressRoute
Posted 8-May-2019 09:25


Independent NZ feature film #statusPending to premiere during WLG-X
Posted 6-May-2019 22:13


The ultimate dog photoshoot with Nokia 9 PureView #ForgottenDogsofInstagram
Posted 6-May-2019 09:41


Nokia 9 PureView available in New Zealand
Posted 6-May-2019 09:06


Motorola Solutions joins local partners to deliver advanced communications network in New Zealand
Posted 30-Apr-2019 21:50



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.