DEV Community

Ethan Vance
Ethan Vance

Posted on Originally published at migservers.com

How to Detect a DDoS Attack on a Linux Server via CLI

#linux #security #devops #tutorial

When your Linux server load suddenly spikes, guessing the cause is not an option. In these critical moments, you need to know immediately whether you are dealing with a legitimate traffic surge, a misbehaving application, or a DDoS attack.

Here is a hands-on guide to diagnosing malicious traffic directly from your terminal using standard Linux command-line utilities.

1. Monitor Network Interfaces (Volumetric Attacks)

The most common DDoS attack is a volumetric flood. Before digging into logs, check the raw traffic hitting your network interfaces.

Real-Time Bandwidth with iftop:

sudo iftop -n
Enter fullscreen mode Exit fullscreen mode

Note: The -n flag prevents DNS resolution, which is crucial during an attack because DNS lookups will slow down the tool.

Check Packets Per Second (PPS) with sar:

Bash
sar -n DEV 1
Enter fullscreen mode Exit fullscreen mode

If your inbound traffic (RX) or PPS is pinned to its absolute limit while CPU usage remains normal, it strongly indicates a Layer 3 network-level flood.

2. Analyze Active TCP States (Protocol Attacks)

If legitimate users are failing to connect, the attacker is likely targeting your server's connection-handling capacity (Layer 4).

Count Total Connections by IP Address:

Bash
ss -H -tn | awk '{print $5}' \vert{} sed 's/:[^:]*$//' | sort | uniq -c | sort -nr | head -10
Enter fullscreen mode Exit fullscreen mode

Detect a SYN Flood Attack:

A SYN flood repeatedly sends initial connection requests (SYN) but never completes the handshake. To count connections stuck in the SYN_RECV state:

Bash
ss -H -n -t state syn-recv | wc -l
Enter fullscreen mode Exit fullscreen mode

Pro-Tip: For a rapid summary of your current TCP states without locking up your terminal, simply type ss -s.

3. Inspect Web Server Logs (Layer 7 HTTP Floods)

If your network bandwidth is fine but your server's CPU or memory is maxed out, you might be facing an HTTP flood.

Identify Top Attacking IPs via Web Logs (Nginx):

Bash
tail -n 10000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -10
Enter fullscreen mode Exit fullscreen mode

Find the Most Hammered URLs:

Bash
tail -n 10000 /var/log/nginx/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -10
Enter fullscreen mode Exit fullscreen mode

4. Defense and Upstream Mitigation

Once the observed traffic patterns are consistent with a DDoS attack, you can begin mitigation.

  • Block specific IPs: sudo iptables -A INPUT -s ATTACKER_IP -j DROP

  • Enable TCP SYN Cookies: sudo sysctl -w net.ipv4.tcp_syncookies=1

Understand the Limits of Local Server Defense:

Local firewalls are useful for targeted attacks, but they cannot stop a massive volumetric flood. If an attacker sends 50Gbps of traffic to your 1Gbps interface, dropping packets locally at the OS level still means your pipe is clogged.

To survive large-scale volumetric or complex multi-vector DDoS attacks, malicious traffic must be filtered before it ever reaches your server through upstream traffic scrubbing or high-capacity network-level mitigation.

Top comments (0)