Results 1 to 6 of 6

Thread: Anyone Else Experiencing DDoS Symptoms

  1. July 9th, 2008, 04:19 PM #1
    steve.milner
    steve.milner is offline
    rebmeM roineS enilnOitnA steve.milner's Avatar
    Join Date
    Jul 2003
    Posts
    1,021

    Anyone Else Experiencing DDoS Symptoms

    On Monday (7th) we experienced severe slowdown of our web servers and 100% processor load across all our cluster CPUs without any corresponding change to software or systems. This occurred 15.30 BST and ended spontaneously at 24.00 BST

    The problem was experienced again on Tuesday (8th) starting at 15.30 BST and has continued since then.

    We are currently analysing the situation.

    Anyone who is experiencing similar problems please let me know.

    Regards,

    Steve
    IT, e-commerce, Retail, Programme & Project Management, EPoS, Supply Chain and Logistic Services. Yorkshire. http://www.bigi.uk.com
    Reply With Quote Reply With Quote
  2. July 9th, 2008, 04:37 PM #2
    MrLinus
    MrLinus is offline
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,323
    Was the network high in correspondence to the high CPU? Did you see a specific process that was high on the process list?

    I haven't seen anything on the sites I manage/admin other than usual stuff.
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage
    Reply With Quote Reply With Quote
  3. July 9th, 2008, 04:43 PM #3
    steve.milner
    steve.milner is offline
    rebmeM roineS enilnOitnA steve.milner's Avatar
    Join Date
    Jul 2003
    Posts
    1,021
    I haven't got the Network Stats at the minute. Our hosting company are slow in responding to requests.

    IIS is the process that is high on the CPU.

    We've tried droping all our "major" pages one by one and then restarting IIS to see if that resolves the problem - No joy but I really need the access logs from the Hosting Co.

    One of our tech guys is debugging the proccess.

    It's looking more and more like a DDoS at the moment but I've been wrong in the past.

    Regards,

    Steve
    IT, e-commerce, Retail, Programme & Project Management, EPoS, Supply Chain and Logistic Services. Yorkshire. http://www.bigi.uk.com
    Reply With Quote Reply With Quote
  4. July 9th, 2008, 08:52 PM #4
    thehorse13
    thehorse13 is offline
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    Is it still happening? Why wait for the logs when you can park a packet capture proggie infront of the box? WireShark anyone?

    --TH13
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
    Reply With Quote Reply With Quote
  5. July 10th, 2008, 09:50 AM #5
    steve.milner
    steve.milner is offline
    rebmeM roineS enilnOitnA steve.milner's Avatar
    Join Date
    Jul 2003
    Posts
    1,021
    TH13,

    It's sorted out now, and a lack of change control has been the culprit! When the logs arrived it pointed us in the direction of the problem.

    We don't have enough control of the servers to be able to install software on them without several forms & requests to the hosting company.

    On a personal note the hosting company is IMHO crap and we need to review our contracts with them.

    Thanks for the help guys.

    Regards,

    Steve
    IT, e-commerce, Retail, Programme & Project Management, EPoS, Supply Chain and Logistic Services. Yorkshire. http://www.bigi.uk.com
    Reply With Quote Reply With Quote
  6. August 5th, 2008, 12:28 AM #6
    davidmn
    davidmn is offline
    Junior Member
    Join Date
    Aug 2008
    Posts
    1

    Post I was to hasty in my previous reply.

    In the start window I get the button 'Try It' which I clicked. But it still ends after 10 minutes.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. Understanding DoS
    By NullDevice in forum The Security Tutorials Forum
    Replies: 21
    Last Post: December 17th, 2003, 10:03 PM
  2. DDoS and IRC
    By NetSyn in forum Miscellaneous Security Discussions
    Replies: 6
    Last Post: May 3rd, 2002, 03:51 PM
  3. New windows DDoS bot OPEN SOURCE
    By NetSyn in forum Security Archives
    Replies: 8
    Last Post: February 3rd, 2002, 09:27 AM
  4. DDoS - Litmus, Gt, Subseven, Xot, Evilbot....
    By acidphreak in forum Non-Security Archives
    Replies: 0
    Last Post: December 20th, 2001, 02:52 PM
  5. Denail Of Service FAQ
    By Ennis in forum The Security Tutorials Forum
    Replies: 4
    Last Post: November 15th, 2001, 07:42 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules