If you are a Linux server administrator, you might need to know how to check your server from DDoS attack. There is no clear explanation why some people do a DDoS attack. Maybe they just want to test your server. Whatever they are, you have to be technically prepared for this issue.
1. Check who are accessing your server right now
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
You will get output like this :
2. The IP that is accessing your server most is the suspected one. Next, you should block the IP by executing this command :
route add suspected_ipaddress reject
Comments