Home / server / Questions / 987879
In Process
Salim Aljayousi
Asked: 2019-10-15 01:21:26 +0800 CST

Mitigating a DDoS attack on a TOR server

  • 772

Running a political blog over TOR network with a .onion domain name

I have been getting DDoS attack, I know how to mitigate an attack on clear net where the packets coming from normal IP addresses, but the case here is different.

All connections to the server are coming from localhost 127.0.0.1

# netstat -anp | grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
  1 195.189.96.148
  1 218.92.0.160
  1 46.185.218.128
  3 
  5 0.0.0.0
  8238 127.0.0.1

as you can see over 8k of connections to the server from 127.0.0.01

tcp        0      0 127.0.0.1:80            127.0.0.1:51588         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51590         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51592         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51594         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51596         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51598         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51600         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51602         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51604         ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:51606         ESTABLISHED
nginx

0 Answers