服务器受攻击，请求帮助防范~~

恍若如梦

服务器第三次受这样的攻击了，几乎占满了全部的宽带，WEB根本没办法访问，请问有什么办法可以这样的攻击失效吗？多谢~

tcp 211 0 219.150.160.251:80 202.103.207.201:2384 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:2641 CLOSE_WAIT
tcp 223 0 219.150.160.251:80 202.103.207.201:3153 CLOSE_WAIT
tcp 211 0 219.150.160.251:80 202.103.207.201:2387 CLOSE_WAIT
tcp 224 0 219.150.160.251:80 202.103.207.201:3155 CLOSE_WAIT
tcp 223 0 219.150.160.251:80 202.103.207.201:3157 CLOSE_WAIT
tcp 213 0 219.150.160.251:80 202.103.207.201:2389 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:3164 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:2112 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:1601 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:2114 CLOSE_WAIT
tcp 213 0 219.150.160.251:80 202.103.207.201:1603 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:1092 CLOSE_WAIT
tcp 188 0 219.150.160.251:80 202.103.207.201:1862 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:1350 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:4936 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:4937 CLOSE_WAIT
tcp 224 0 219.150.160.251:80 202.103.207.201:2378 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:4939 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:4941 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:4942 CLOSE_WAIT
tcp 223 0 219.150.160.251:80 202.103.207.201:3150 CLOSE_WAIT
tcp 223 0 219.150.160.251:80 202.103.207.201:3151 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:2639 CLOSE_WAIT
tcp 223 0 219.150.160.251:80 202.103.207.201:2160 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:2672 CLOSE_WAIT
tcp 1 0 219.150.160.251:80 202.103.207.201:4976 CLOSE_WAIT
tcp 223 0 219.150.160.251:80 202.103.207.201:2161 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:3185 CLOSE_WAIT
tcp 224 0 219.150.160.251:80 202.103.207.201:3186 CLOSE_WAIT
tcp 228 0 219.150.160.251:80 207.46.98.76:3052 CLOSE_WAIT
tcp 0 0 219.150.160.251:80 202.103.207.201:1396 CLOSE_WAIT
tcp 220 0 219.150.160.251:80 202.103.207.201:1654 CLOSE_WAIT

snoopyxp

拿iptables把相应的ip封了。

konds

目前对与TCP/IP的拒绝服务攻击还没有很好的解决办法。郁闷啊

hyoga

iptables确实是一个没办法的办法，另外可以修改apache配置文件，限制每ip的最大连接数等.

恍若如梦

Post by hyoga
iptables确实是一个没办法的办法，另外可以修改apache配置文件，限制每ip的最大连接数等.

请问怎么做呢?好像有文章说过,不过我不记得在那了?

碧轩

[QUOTA]防止 sync flood 攻擊的設定:

iptables -N synfoold
iptables -A synfoold -p tcp --syn -m limit --limit 1/s -j RETURN
iptables -A synfoold -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp -m state --state NEW -j synfoold

這個方式對於一個很忙碌的站台?碚f，這個設定方式會不會有不良影響呢？
測試過一個很忙碌的站台用這個設定，老?說?K不好....
所以也許可以調整時間與次數的觸發值。[/QUOTA]

详细可以看：http://www1.ourlinux.net/bbs/showforum.php?showtopic=306