EAK Just Debian Guru Page :) Just another Linux weblog

5Dec/09Off

Detect DDOS if it is an attack

http://forums.digitalpoint.com/showthread.php?t=592096
Depending on what type of traffic and also what type of attack it is you may need to reconfigure a number of system variables to prepare the system for extra load as it processes which connection is technically " fake ".

There are a number of tools -

Check to see if it is an attack - :: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n