(D)DoS detection

DoS vs DDoS
The server’s load is high due to (Distributed) Denial of Service attacks ((D)DoS).In the case of DoS attacks, there are multiple connections established from an IP, and BitNinja will block the IP address if the number of connections reaches our threshold.

In the case of DDoS, the attack comes from multiple IP addresses at the same time. None of the IP addresses establish enough connections at the time to identify the requests as DoS attacks but their combined number of connections still causes issues.

If you suspect that you are under a DDOS attack, then enable the rate limiting feature in BitNinja.

Solution

BitNinja blocks most of the infected server’s IP addresses via the challenge list or the block list. So most of the malicious attacks are already blocked

1. Check the number of connections per IP addresses with this command:
   netstat -ant | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn|head -n 10
2. Lower the DoS protection’s threshold:
   
   Open the Configuration menu on your BitNinja dashboard.
   Select the setting level on the left side. (server-level, server group-level, account-level)
   Change the value of the Threshold under the DoS Detection module
   
   

3. Restart BitNinja with service bitninja restart command
4. Run: netstat -antu | grep -v LISTEN | awk '{print $5}' | cut -d: -f1 | sort | uniq -c again to check the results

The default threshold for ports 80 and 443 is 200 connections per IP address. If the attack is coming via HTTP or HTTPS then you will need to modify the module’s config because it currently can’t be changed from the dashboard.

1. Open the following config file /etc/bitninja/DosDetection/config.ini with your preferred text editor.
   for example: nano /etc/bitninja/DosDetection/config.ini
   
2. Under the [tresholds] flag with the local[http] and local[https] variables you can limit the number of connections per Ip address.
   By default their values are set to 200, but you can change them according to your preference.
   local[http]=200
   local[https]=200
   
3. Save the changes.
   
4. Restart BitNinja with the service bitninja restart command.
   

If the WAF module is enabled then the attackers are connecting via port 60300 and port 60301.
In the case of these ports, the default threshold for the DosDetection module is also 200.

1. Open the following config file /etc/bitninja/DosDetection/config.ini with your preferred text editor.
   for example: nano /etc/bitninja/DosDetection/config.ini
   
2. Under the [tresholds] flag with the local[wafHttp] and local[wafHttps] variables you can limit the number of connections per Ip address.
   By default their values are set to 200, but you can change them according to your preference.
   local[wafHttp]=200
   local[wafHttps]=200
   
3. Save the changes.
   
4. Restart BitNinja with the service bitninja restart command.
   

You can block IP addresses manually by challenge listing them or block listing them from the Dashboard

• Go to the Firewall -> Block list menu, and add the IP addresses to your block list or use
  bitninjacli --blacklist --add=<IP address>
• Insert the IP into the search field and click on the “+ challenge list” button or use bitninjacli --greylist --add=<IP address>