DDoS Attack Emergency Response Plan

Correct and rapid response during a DDoS attack is critical to minimizing service disruption. This guide covers the entire emergency response process step by step, from attack detection to post-mortem analysis.

Don't panic during a DDoS attack. Follow the steps in this guide sequentially. The REXE support team is available 24/7.

Attack Detection

Early detection of a DDoS attack is the first step for effective response.

Symptoms

Symptom	Possible Attack Type
Website slow or unreachable	Layer 7 HTTP flood
Cannot establish SSH connection	Layer 4 SYN/TCP flood
High bandwidth usage	Volumetric attack
CPU/RAM normal but site slow	Network level attack
CPU 100% but traffic normal	Application layer attack

Quick Diagnosis Commands

hljs bash

# 1. Server reachability check
ping -c 5 SERVER_IP

# 2. Network connection status
ss -s

# 3. Active connection count
ss -ant | wc -l

# 4. Top connecting IPs
ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# 5. SYN-RECV state connections
ss -ant state syn-recv | wc -l

# 6. Bandwidth usage
ifstat -i eth0 1 5

# 7. System resources
top -bn1 | head -5
free -h

Traffic Analysis

hljs bash

# Real-time traffic monitoring
sudo iftop -i eth0 -n

# Protocol-based traffic distribution
sudo tcpdump -i eth0 -c 10000 -nn 2>/dev/null | awk '{print $3}' | cut -d. -f5 | sort | uniq -c | sort -rn | head -10

# Source IP analysis
sudo tcpdump -i eth0 -c 5000 -nn 2>/dev/null | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Packet capture for detailed analysis
sudo tcpdump -i eth0 -c 50000 -w /tmp/ddos-capture.pcap

Emergency Response Steps

Step 1: Assess the Situation (0-5 minutes)

hljs bash

# Determine attack type
# High SYN-RECV = SYN Flood
ss -ant state syn-recv | wc -l

# High ESTABLISHED = HTTP Flood
ss -ant state established | wc -l

# High UDP traffic = UDP Flood
sudo tcpdump -i eth0 udp -c 1000 -nn -q 2>/dev/null | wc -l

# HTTP request analysis
tail -1000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

Step 2: Emergency Blocking (5-15 minutes)

hljs bash

#!/bin/bash
# emergency-block.sh

# Detect top attacking IPs
ATTACKERS=$(ss -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -50 | awk '$1 > 100 {print $2}')

# Block IPs
for ip in $ATTACKERS; do
    iptables -I INPUT -s $ip -j DROP
    echo "Blocked: $ip"
done

# Bulk blocking with ipset
ipset create blacklist hash:net
for ip in $ATTACKERS; do
    ipset add blacklist $ip
done
iptables -I INPUT -m set --match-set blacklist src -j DROP

Step 3: Tune Kernel Parameters (5 minutes)

hljs bash

# Emergency sysctl settings
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_max_syn_backlog=65536
sysctl -w net.ipv4.tcp_synack_retries=1
sysctl -w net.netfilter.nf_conntrack_max=2000000
sysctl -w net.core.somaxconn=65536
sysctl -w net.ipv4.tcp_tw_reuse=1

Step 4: Web Server Configuration (10 minutes)

hljs nginx

# Nginx emergency configuration
# /etc/nginx/conf.d/emergency.conf

limit_req_zone $binary_remote_addr zone=emergency:20m rate=5r/s;
limit_conn_zone $binary_remote_addr zone=emergency_conn:20m;

server {
    limit_req zone=emergency burst=10 nodelay;
    limit_conn emergency_conn 20;
    
    client_max_body_size 1m;
    client_body_timeout 5s;
    client_header_timeout 5s;
    
    if ($http_user_agent ~* (bot|crawler|spider|scan|attack)) {
        return 403;
    }
}

hljs bash

sudo nginx -t && sudo systemctl reload nginx

Step 5: Enable Cloudflare Under Attack Mode (2 minutes)

hljs bash

curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"under_attack"}'

Step 6: Path Panel Rules (5 minutes)

Through Path Panel:

Filter attack sources
Add rate limiting rules
Apply geo-blocking if needed
Enable protocol filters

ISP and Upstream Communication

REXE Support Request Template

Subject: DDoS Attack - Emergency Response Required

Server IP: [IP_ADDRESS]
Attack Start: [DATE/TIME]
Attack Type: [SYN Flood / UDP Flood / HTTP Flood / Unknown]
Impact: [Full outage / Partial slowdown / Intermittent access]

Measures Taken:
- iptables rules applied
- Cloudflare Under Attack mode active
- Kernel parameters tuned

Additional Info:
- Attack traffic: ~[X] Gbps
- Source IP count: ~[X]
- Target ports: [80, 443, etc.]

Post-Attack Procedures

Post-Mortem Analysis

hljs bash

# Analyze captured traffic
tcpdump -r /tmp/ddos-capture.pcap -nn | head -100

# Attack statistics
tcpdump -r /tmp/ddos-capture.pcap -nn | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Log analysis
grep -c "" /var/log/nginx/access.log
awk '{print $1}' /var/log/nginx/access.log | sort -u | wc -l

Remove Emergency Rules

hljs bash

# After attack ends, remove emergency rules
# 1. Return Cloudflare to normal mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/security_level" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"value":"medium"}'

# 2. Clean emergency iptables rules
iptables -D INPUT -m set --match-set blacklist src -j DROP
ipset destroy blacklist

# 3. Remove Nginx emergency config
rm /etc/nginx/conf.d/emergency.conf
sudo nginx -t && sudo systemctl reload nginx

Prevention Strategies

Proactive Protection Checklist

Path Panel filter rules configured
Cloudflare integration set up
Rate limiting applied (Nginx/Apache)
Kernel parameters optimized
Fail2Ban installed and configured
Monitoring tools installed (Uptime Kuma, Grafana)
Emergency response scripts prepared
Communication plan created

Automatic Detection Script

hljs bash

#!/bin/bash
# ddos-monitor.sh - Run with cron (every minute)

THRESHOLD=500
CONNECTIONS=$(ss -ant | wc -l)

if [ $CONNECTIONS -gt $THRESHOLD ]; then
    echo "WARNING: High connection count: $CONNECTIONS" | \
        mail -s "DDoS Alert - $(hostname)" admin@example.com
    /usr/local/bin/emergency-block.sh
    logger "DDoS alert: $CONNECTIONS connections detected"
fi

Test your emergency response plan regularly. The plan should be ready when an attack occurs. Keep your contact information with the REXE support team up to date.

Conclusion

Being prepared for DDoS attacks is as important as responding quickly and effectively during an attack. Plan the steps in this guide in advance, prepare scripts, and conduct regular drills. Create a multi-layered defense strategy with Path Panel protection and Cloudflare integration offered by REXE infrastructure.

DDoS Attack Emergency Response Plan

Table of Contents