How to Check for a DDoS Attack on Linux: Detection and Mitigation Steps

A Distributed Denial of Service (DDoS) attack can overwhelm a server or network with a flood of malicious traffic, rendering services inaccessible. If you’re running a Linux server, it’s essential to know how to check for signs of a DDoS attack, as well as how to mitigate its effects. This guide walks you through the process of detecting a DDoS attack on Linux and the steps to protect your system.

Signs of a DDoS Attack on Linux

Before diving into how to check for a DDoS attack, it’s important to understand the common symptoms. Here are some of the primary signs that may indicate your Linux server is under a DDoS attack:

• Slow network performance: Sudden sluggishness or timeouts when accessing the server could be a sign that the server is overwhelmed with traffic.
• High CPU or memory usage: Unexplained spikes in resource consumption could indicate that the server is struggling to handle the excessive traffic from a DDoS attack.
• Server crashes or frequent reboots: If your server becomes unresponsive or crashes repeatedly, a DDoS attack may be the cause.
• Unusual network traffic: You may notice an abnormal surge in incoming traffic, especially from specific IP addresses or geolocations.

How to Check for a DDoS Attack on Linux

1. Monitor Network Traffic with netstat

One of the first tools to check for a DDoS attack is netstat. It helps you identify open ports and active connections to your server, which can be useful in spotting DDoS attacks that target specific services.

Run the following command to see all active connections:

netstat -anp

Look for:

• Multiple connections from the same IP: If you notice a single IP address with multiple simultaneous connections, this could be a sign of a DDoS attack.
• High number of connections on specific ports: This can indicate that a particular service on your server is being targeted.

2. Check the Traffic Volume with iftop

iftop is a real-time network monitoring tool for Linux that shows which IPs are using the most bandwidth.

To install iftop:

sudo apt-get install iftop   # For Debian/Ubuntu-based systems
sudo yum install iftop       # For CentOS/RHEL-based systems

Once installed, run the following command:

sudo iftop

Pay attention to:

• High traffic from specific IPs: This indicates a concentration of incoming traffic from one or a few sources, which is typical of DDoS attacks.
• Excessive inbound traffic: Unusually high inbound traffic may be an indication of a volumetric DDoS attack.

3. Use ss to Analyze Network Connections

The ss command is another useful tool for analyzing network connections on Linux. It provides detailed information about network sockets, which can help you detect DDoS attacks.

Run the following command to check for connections on a specific port:

ss -tuln

Look for:

• Abnormal number of connections: A large number of connections to a single service (e.g., HTTP or SSH) could indicate a DDoS attack.
• Syn floods: SYN flood attacks may be noticeable if there are a high number of half-open connections (connections in SYN_RECV state).

4. Examine System Logs for Anomalies

System logs can provide valuable information about what’s happening on your Linux server. The /var/log/syslog or /var/log/messages logs may contain error messages or patterns of unusual traffic.

To view logs:

sudo tail -f /var/log/syslog

Look for:

• Unusual errors: Repeated errors or alerts related to the network or application layer may be indicative of a DDoS attack.
• Sudden spikes in traffic or requests: Logs showing a dramatic increase in requests to a web server or other service can point to DDoS activity.

5. Use tcpdump for Deep Packet Inspection

If you’re dealing with a more complex DDoS attack, tcpdump can help you capture network packets and analyze traffic in detail.

Install tcpdump (if not already installed):

sudo apt-get install tcpdump

Capture packets on a specific interface:

sudo tcpdump -i eth0

Look for:

• Unusual packets: DDoS attacks often involve unusual or malformed packets.
• Traffic patterns: A high frequency of packets from the same IP addresses, or unusual protocols, may indicate a flood attack.

How to Mitigate a DDoS Attack on Linux

If you’ve detected signs of a DDoS attack, it’s crucial to take immediate action to mitigate its impact. Here are some mitigation strategies:

1. Block Malicious IPs

Once you’ve identified malicious IP addresses responsible for the DDoS traffic, you can block them using iptables (Linux firewall).

To block a specific IP:

sudo iptables -A INPUT -s <malicious-IP> -j DROP

Replace <malicious-IP> with the IP address you want to block.

2. Limit Connections per IP

To prevent a DDoS attack from overwhelming your server, you can limit the number of concurrent connections per IP address. Use iptables to limit connections to a specific port.

Example command to limit SSH connections:

sudo iptables -A INPUT -p tcp --dport 22 -i eth0 -m conntrack --ctstate NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 22 -i eth0 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 3 -j DROP

This limits the number of new connections to 3 per minute from a single IP.

3. Use Fail2Ban for Automated Protection

Fail2Ban is an automated tool that monitors log files for signs of malicious activity and blocks suspicious IP addresses.

Install Fail2Ban:

sudo apt-get install fail2ban

Fail2Ban automatically configures protections against certain types of DDoS attacks, like SSH brute-force attacks. You can customize its settings to protect against other forms of attacks as well.

4. Enable Rate Limiting on Web Servers

If your web server is under attack, you can configure rate limiting to prevent DDoS traffic from overwhelming it.

For Apache, you can use mod_evasive or mod_security for rate limiting and blocking suspicious requests.

For Nginx, enable the limit_req module:

limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=1r/s;
server {
    location / {
        limit_req zone=req_limit_per_ip burst=5 nodelay;
    }
}

5. Implement DDoS Protection Services

Consider using DDoS mitigation services like Cloudflare or AWS Shield. These services can filter out malicious traffic before it reaches your server, helping you maintain uptime during an attack.

Conclusion

Detecting a DDoS attack on your Linux server requires vigilant monitoring of network traffic and system logs. Using tools like netstat, iftop, ss, tcpdump, and system logs can help identify signs of an attack. Once detected, immediate action—such as blocking malicious IPs, enabling rate limiting, and using firewall rules—can help mitigate the effects. For enhanced protection, consider using automated tools like Fail2Ban or subscribing to DDoS protection services.

By staying proactive and aware, you can reduce the risk of downtime and ensure that your server stays protected against potential DDoS attacks.