My server is DDoSed by TurkTelekom

[ACiD_CORE]

When i do netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

there is tons of ips like this some of them goes to connection number of above 60!

its TurkTelekom

how to block it ?

     10 46.196.202.150
     10 78.162.150.28
     10 78.172.180.188
     10 85.105.253.111
     10 88.247.41.183
     10 88.247.45.166
     10 88.252.101.179
     11 78.189.219.197
     11 88.247.227.224
     12 88.235.132.213
     12 88.243.201.49
     13 85.100.195.146
     13 88.230.178.122
     13 88.233.63.25

ACiD_CORE Reviewed by ACiD_CORE on 17th Oct 2012. My server is DDoSed by TurkTelekom When i do netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1 there is tons of ips like this some of them goes to connection number of above 60! its TurkTelekom how to block it ? 10 46.196.202.150 10 78.162.150.28 Rating: 5

[Ifirst]

Easy dude install CSF , its a firewall that automatically protect your server against DDos
Here is a tutorial

http://www.besthostingforums.com/18-...ux-server.html

Move to part

3.Install Firewall(I recommend CSF)

Note : In your case CSF limit should be 50
CT_LIMIT = "40"
This way anyone having more than 50 get banned
Remember than 30-40 is recommanded for most application

[l0calh0st]

TurkTelekom is an ISP. So don't blame them.

[ACiD_CORE]

installing csf will eat more memory i think.

is there any way to block whole dynamic.ttnet.com.tr
or ip range like 78.*.*.* ?

[Ifirst]

@l0calh0st
Someone may lease TurkTelekom servers to ddos him
Anyone can ddos from any part of the world using any isp server or bots

---------- Post added at 09:09 AM ---------- Previous post was at 09:06 AM ----------

@ACiD_CORE csf don't eat much memory
If you want you can set
CT_INTERVAL = "60"
This way CSF will check your server every 60 seconds(aka 1 min) and use less resource

[Cometolearn]

use cloudflare

[Ifirst]

Cloudflare sucks for some kind of site eespecially if you have gr8 traffic
for e.g cloudflare couldn't support lulzimg
Also there is the dns hassle and i think CSF is a better choice here (Free and efficient)

[ACiD_CORE]

so can i block whole dynamic.ttnet.com.tr ?via etc/hosts or ?

[Ifirst]

better install CSF and chill
its all automated

[ACiD_CORE]

okey i am installed, now how to check it works ?

i can not load my site since it ddosed hardly ...