Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a dedicated server and it went down hours ago.

Just wondering if this happened because of a DDoS attack.

I got the bandwidth graph from my hosting provider, it clearly shows huge traffic before server stopped responding.

enter image description here

share|improve this question
    
Maybe I've misinterpreted the graph, but whilst there appears to be a small spike in incoming traffic (blue line), the majority of the bandwidth is outgoing? –  w3d Jun 14 at 9:37
    
As dartonw said, you should take a look into the logfiles. Logstalgia might help you as it wonderful visualizes the requests that were made (Logstalgia is not only suited for Apache logs). You should also look at a packet/sec chart. A TCP connection state chart, showing in which state (established, syn-sent, close_wait, ...) a connection is, might be interesting too. –  try-catch-finally Jun 14 at 10:40
add comment

2 Answers 2

Without the spike making 95th percentile 129 Mb, it looks like it would have been around 70 Mb - an 85% increase. That's significant, but the traffic alone isn't enough to determine the cause. You will need to bring the server back up (offline, if possible) and examine the log files to tell if it was a DDoS, as there could be other explanations depending on the services and content provided by that server.

share|improve this answer
add comment

You show an increase in traffic, but I don't know that I'd call this huge.

It's possible that there's an effective DOS involved, but no evidence here that it's malicious, or distributed. Either of those are possible, but it's more likely that this was either because of some inconsiderately written web crawler started working over your site, or because something on your site got genuinely popular for some reason.

I gather that the traffic dropped off, but your system did not recover? For how long?

A common scenario is that a system is not configured for high load, and when it gets more load, too many processes start up, and the system runs out of RAM, and starts swapping. In this situation, Performance can take a serious hit, but usually doesn't go to zero, and it may recover on its own (though you may not be prepared to wait for it). When swap space also runs out, the system starts killing processes. That often works, but sometimes a process that is killed is a critical one, and so your system does not recover.

Where you say the server stopped responding, do you mean web response only, or were you trying ssh, or something else? Ping?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.