Skip to main content
Back to Category

DDoS Attack Emergency Response Plan

Complete guide on DDoS attack detection, emergency response steps, traffic analysis, ISP communication, post-mortem analysis, and prevention strategies.

Read time: 14 min DDoS Protection & Security
ddosincident-responseemergencytraffic-analysissecuritypost-mortem
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

DDoS Attack Emergency Response Plan

Correct and rapid response during a DDoS attack is critical to minimizing service disruption. This guide covers the entire emergency response process step by step, from attack detection to post-mortem analysis.

Don't panic during a DDoS attack. Follow the steps in this guide sequentially. The REXE support team is available 24/7.

Attack Detection

Early detection of a DDoS attack is the first step for effective response.

Symptoms

SymptomPossible Attack Type
Website slow or unreachableLayer 7 HTTP flood
Cannot establish SSH connectionLayer 4 SYN/TCP flood
High bandwidth usageVolumetric attack
CPU/RAM normal but site slowNetwork level attack
CPU 100% but traffic normalApplication layer attack

Quick Diagnosis Commands

hljs bash
# 1. Server reachability check
ping -c 5 SERVER_IP

# 2. Network connection status
ss -s

# 3. Active connection count
ss -ant | wc -l

# 4. Top connecting IPs
ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# 5. SYN-RECV state connections
ss -ant state syn-recv | wc -l

# 6. Bandwidth usage
ifstat -i eth0 1 5

# 7. System resources
top -bn1 | head -5
free -h

Traffic Analysis

hljs bash
# Real-time traffic monitoring
sudo iftop -i eth0 -n

# Protocol-based traffic distribution
sudo tcpdump -i eth0 -c 10000 -nn 2>/dev/null | awk '{print $3}' | cut -d. -f5 | sort | uniq -c | sort -rn | head -10

# Source IP analysis
sudo tcpdump -i eth0 -c 5000 -nn 2>/dev/null | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Packet capture for detailed analysis
sudo tcpdump -i eth0 -c 50000 -w /tmp/ddos-capture.pcap

Emergency Response Steps

Step 1: Assess the Situation (0-5 minutes)

hljs bash
# Determine attack type
# High SYN-RECV = SYN Flood
ss -ant state syn-recv | wc -l

# High ESTABLISHED = HTTP Flood
ss -ant state established | wc -l

# High UDP traffic = UDP Flood
sudo tcpdump -i eth0 udp -c 1000 -nn -q 2>/dev/null | wc -l

# HTTP request analysis
tail -1000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

Step 2: Emergency Blocking (5-15 minutes)

hljs bash
#!/bin/bash
# emergency-block.sh

# Detect top attacking IPs
ATTACKERS=$(ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -50 | awk '$1 > 100 {print $2}')

# Block IPs
for ip in $ATTACKERS; do
    iptables -I INPUT -s $ip -j DROP
    echo "Blocked: $ip"
done

# Bulk blocking with ipset
ipset create blacklist hash:net
for ip in $ATTACKERS; do
    ipset add blacklist $ip
done
iptables -I INPUT -m set --match-set blacklist src -j DROP

Step 3: Tune Kernel Parameters (5 minutes)

hljs bash
# Emergency sysctl settings
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_max_syn_backlog=65536
sysctl -w net.ipv4.tcp_synack_retries=1
sysctl -w net.netfilter.nf_conntrack_max=2000000
sysctl -w net.core.somaxconn=65536
sysctl -w net.ipv4.tcp_tw_reuse=1

Step 4: Web Server Configuration (10 minutes)

hljs nginx
# Nginx emergency configuration
# /etc/nginx/conf.d/emergency.conf

limit_req_zone $binary_remote_addr zone=emergency:20m rate=5r/s;
limit_conn_zone $binary_remote_addr zone=emergency_conn:20m;

server {
    limit_req zone=emergency burst=10 nodelay;
    limit_conn emergency_conn 20;
    
    client_max_body_size 1m;
    client_body_timeout 5s;
    client_header_timeout 5s;
    
    if ($http_user_agent ~* (bot|crawler|spider|scan|attack)) {
        return 403;
    }
}
hljs bash
sudo nginx -t && sudo systemctl reload nginx

Step 5: Enable Cloudflare Under Attack Mode (2 minutes)

hljs bash
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"under_attack"}'

Step 6: Path Panel Rules (5 minutes)

Through Path Panel:

  1. Filter attack sources
  2. Add rate limiting rules
  3. Apply geo-blocking if needed
  4. Enable protocol filters

ISP and Upstream Communication

REXE Support Request Template

Subject: DDoS Attack - Emergency Response Required

Server IP: [IP_ADDRESS]
Attack Start: [DATE/TIME]
Attack Type: [SYN Flood / UDP Flood / HTTP Flood / Unknown]
Impact: [Full outage / Partial slowdown / Intermittent access]

Measures Taken:
- iptables rules applied
- Cloudflare Under Attack mode active
- Kernel parameters tuned

Additional Info:
- Attack traffic: ~[X] Gbps
- Source IP count: ~[X]
- Target ports: [80, 443, etc.]

Post-Attack Procedures

Post-Mortem Analysis

hljs bash
# Analyze captured traffic
tcpdump -r /tmp/ddos-capture.pcap -nn | head -100

# Attack statistics
tcpdump -r /tmp/ddos-capture.pcap -nn | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Log analysis
grep -c "" /var/log/nginx/access.log
awk '{print $1}' /var/log/nginx/access.log | sort -u | wc -l

Remove Emergency Rules

hljs bash
# After attack ends, remove emergency rules
# 1. Return Cloudflare to normal mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"medium"}'

# 2. Clean emergency iptables rules
iptables -D INPUT -m set --match-set blacklist src -j DROP
ipset destroy blacklist

# 3. Remove Nginx emergency config
rm /etc/nginx/conf.d/emergency.conf
sudo nginx -t && sudo systemctl reload nginx

Prevention Strategies

Proactive Protection Checklist

  1. Path Panel filter rules configured
  2. Cloudflare integration set up
  3. Rate limiting applied (Nginx/Apache)
  4. Kernel parameters optimized
  5. Fail2Ban installed and configured
  6. Monitoring tools installed (Uptime Kuma, Grafana)
  7. Emergency response scripts prepared
  8. Communication plan created

Automatic Detection Script

hljs bash
#!/bin/bash
# ddos-monitor.sh - Run with cron (every minute)

THRESHOLD=500
CONNECTIONS=$(ss -ant | wc -l)

if [ $CONNECTIONS -gt $THRESHOLD ]; then
    echo "WARNING: High connection count: $CONNECTIONS" | \
        mail -s "DDoS Alert - $(hostname)" admin@example.com
    /usr/local/bin/emergency-block.sh
    logger "DDoS alert: $CONNECTIONS connections detected"
fi

Test your emergency response plan regularly. The plan should be ready when an attack occurs. Keep your contact information with the REXE support team up to date.

Conclusion

Being prepared for DDoS attacks is as important as responding quickly and effectively during an attack. Plan the steps in this guide in advance, prepare scripts, and conduct regular drills. Create a multi-layered defense strategy with Path Panel protection and Cloudflare integration offered by REXE infrastructure.

Frequently Asked Questions

How do I know if I'm under a DDoS attack?

Excessive slowdown or inaccessibility of your website, inability to establish SSH connections, abnormal bandwidth usage, and high connection counts are symptoms of a DDoS attack. You can quickly diagnose with 'ss -s' and 'iftop' commands.

What should I do first during an attack?

First, determine the attack type (SYN flood, HTTP flood, UDP flood). Then block the top attacking IPs with iptables, tune kernel parameters, and enable Cloudflare Under Attack mode. Notify the REXE support team.

How long does a DDoS attack last?

DDoS attacks can last from a few minutes to several days. Most attacks end within 1-2 hours. However, targeted attacks can continue for days. The impact is minimized as long as your protection measures are active.

How can I reach the REXE support team?

You can create a support ticket from the REXE customer panel or call the 24/7 support line for emergencies. Include server IP, attack start time, attack type, and measures taken in your support request.

What should I do after the attack?

After the attack ends, remove emergency rules, return Cloudflare to normal mode, perform log analysis, and prepare a post-mortem report. Document attack sources and types to prepare for future attacks.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps