AntiDDoS Defence

[macdonald12]

Is this ddos "from here down" there are many ips that repeat, I have a d-link router this log is from there form the firewall. The thing is I block this ips but had 0 effect and they still show in the router log. and the net connection falls for some time.

If you're sure that the logs indicate an attack and not something else, send an email to the IP's service provider and have them deal with it. Don't forget to attach the logs.

In this case, that would be abuse@rcs-rds.ro

If it's a genuine attack, probably a comprimised server is responsible. But still it's a good idea to contact the abuse department and let them take it offline.

It's probably just a port scan though, i believe i saw NetBIOS's port 139 there..

[Lupu1]

Is this ddos "from here down" there are many ips that repeat, I have a d-link router this log is from there form the firewall. The thing is I block this ips but had 0 effect and they still show in the router log. and the net connection falls for some time.

If you're sure that the logs indicate an attack and not something else, send an email to the IP's service provider and have them deal with it. Don't forget to attach the logs.

In this case, that would be abuse@rcs-rds.ro

If it's a genuine attack, probably a comprimised server is responsible. But still it's a good idea to contact the abuse department and let them take it offline.

It's probably just a port scan though, i believe i saw NetBIOS's port 139 there..

Well what ddos can it be and to not detect it ? Every time my server fall that ips was in the logs.