DDoS-Angriff Notfallplan

# 1. Server-Erreichbarkeitsprüfung
ping -c 5 SERVER_IP

# 2. Netzwerkverbindungsstatus
ss -s

# 3. Aktive Verbindungsanzahl
ss -ant | wc -l

# 4. Top verbindende IPs
ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# 5. SYN-RECV-Verbindungen
ss -ant state syn-recv | wc -l

# 6. Bandbreitennutzung
ifstat -i eth0 1 5

# 7. Systemressourcen
top -bn1 | head -5
free -h

# Echtzeit-Verkehrsüberwachung
sudo iftop -i eth0 -n

# Quell-IP-Analyse
sudo tcpdump -i eth0 -c 5000 -nn 2>/dev/null | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Paketerfassung für detaillierte Analyse
sudo tcpdump -i eth0 -c 50000 -w /tmp/ddos-capture.pcap

# Angriffstyp bestimmen
ss -ant state syn-recv | wc -l
ss -ant state established | wc -l
sudo tcpdump -i eth0 udp -c 1000 -nn -q 2>/dev/null | wc -l
tail -1000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

#!/bin/bash
# emergency-block.sh
ATTACKERS=$(ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -50 | awk '$1 > 100 {print $2}')

for ip in $ATTACKERS; do
    iptables -I INPUT -s $ip -j DROP
    echo "Blockiert: $ip"
done

ipset create blacklist hash:net
for ip in $ATTACKERS; do
    ipset add blacklist $ip
done
iptables -I INPUT -m set --match-set blacklist src -j DROP

sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_max_syn_backlog=65536
sysctl -w net.ipv4.tcp_synack_retries=1
sysctl -w net.netfilter.nf_conntrack_max=2000000
sysctl -w net.core.somaxconn=65536

# Nginx Notfall-Konfiguration
limit_req_zone $binary_remote_addr zone=emergency:20m rate=5r/s;
limit_conn_zone $binary_remote_addr zone=emergency_conn:20m;

server {
    limit_req zone=emergency burst=10 nodelay;
    limit_conn emergency_conn 20;
    client_max_body_size 1m;
    client_body_timeout 5s;
    client_header_timeout 5s;
}

curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"under_attack"}'

Betreff: DDoS-Angriff - Notfallreaktion erforderlich

Server-IP: [IP_ADRESSE]
Angriffsbeginn: [DATUM/UHRZEIT]
Angriffstyp: [SYN Flood / UDP Flood / HTTP Flood / Unbekannt]
Auswirkung: [Vollständiger Ausfall / Teilweise Verlangsamung]

Ergriffene Maßnahmen:
- iptables-Regeln angewendet
- Cloudflare Under Attack-Modus aktiv
- Kernel-Parameter angepasst

tcpdump -r /tmp/ddos-capture.pcap -nn | head -100
tcpdump -r /tmp/ddos-capture.pcap -nn | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Cloudflare auf Normalmodus zurücksetzen
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"medium"}'

# Notfall-iptables-Regeln bereinigen
iptables -D INPUT -m set --match-set blacklist src -j DROP
ipset destroy blacklist

# Nginx-Notfallkonfiguration entfernen
rm /etc/nginx/conf.d/emergency.conf
sudo nginx -t && sudo systemctl reload nginx

#!/bin/bash
# ddos-monitor.sh
THRESHOLD=500
CONNECTIONS=$(ss -ant | wc -l)

if [ $CONNECTIONS -gt $THRESHOLD ]; then
    echo "WARNUNG: Hohe Verbindungsanzahl: $CONNECTIONS" | \
        mail -s "DDoS-Alarm - $(hostname)" admin@example.com
    /usr/local/bin/emergency-block.sh
    logger "DDoS-Alarm: $CONNECTIONS Verbindungen erkannt"
fi