MediaLayer was in need of a speech to involuntarily mitigate (D)DoS attacks. The necessity started when MediaLayer was the target of a rather large, consistent attack originating from multiple IP addresses. Each IP would have a large amount of relations to the server, as shown as by:

netstat -ntu | awk '{print }' | cut -d: -f1 | sort | uniq -c | sort -n

It became a general practice for us to be blocking IPs with a large amount of relations, but we wanted to get this automated. Zaf made a speech mitigate this kind of attack. We kept improving it to meet our own needs and eventually posted it on Defender Hosting’s Forum. (D)DoS-Deflate is now recognized as one of the best ways to block a (D)DoS attack at the software level.

You can view a copy of the license agreement here.

wget http://www.inetbase.com/scripts/ddos/install.sh<br />chmod 0700 install.sh<br />./install.sh<br />

wget http://www.inetbase.com/scripts/ddos/uninstall.ddos<br />chmod 0700 uninstall.ddos<br />./uninstall.ddos<br />

• whitelisting possible by adding IPs in /usr/local/ddos/ignore.ip.list
• it uses this file to avoid banning the ip again (it was handling this differently and was a bit slower too)

It remains the same as last time (uninstall and reinstall the speech), and you need to make changes to the conf to suit your preferences (The defaulting values ban an ip with 150 relations (or more) for 600 seconds and run the speech every minute)

REFERENCES

http://deflate.medialayer.com/ancient/