I have a dedicated server and it went down hours ago.

Just wondering if this happened because of a DDoS attack.

I got the bandwidth graph from my hosting provider, it clearly shows huge traffic before server stopped responding.

enter image description here

  • Maybe I've misinterpreted the graph, but whilst there appears to be a small spike in incoming traffic (blue line), the majority of the bandwidth is outgoing? – MrWhite Jun 14 '14 at 9:37
  • As dartonw said, you should take a look into the logfiles. Logstalgia might help you as it wonderful visualizes the requests that were made (Logstalgia is not only suited for Apache logs). You should also look at a packet/sec chart. A TCP connection state chart, showing in which state (established, syn-sent, close_wait, ...) a connection is, might be interesting too. – try-catch-finally Jun 14 '14 at 10:40

Without the spike making 95th percentile 129 Mb, it looks like it would have been around 70 Mb - an 85% increase. That's significant, but the traffic alone isn't enough to determine the cause. You will need to bring the server back up (offline, if possible) and examine the log files to tell if it was a DDoS, as there could be other explanations depending on the services and content provided by that server.

| improve this answer | |

You show an increase in traffic, but I don't know that I'd call this huge.

It's possible that there's an effective DOS involved, but no evidence here that it's malicious, or distributed. Either of those are possible, but it's more likely that this was either because of some inconsiderately written web crawler started working over your site, or because something on your site got genuinely popular for some reason.

I gather that the traffic dropped off, but your system did not recover? For how long?

A common scenario is that a system is not configured for high load, and when it gets more load, too many processes start up, and the system runs out of RAM, and starts swapping. In this situation, Performance can take a serious hit, but usually doesn't go to zero, and it may recover on its own (though you may not be prepared to wait for it). When swap space also runs out, the system starts killing processes. That often works, but sometimes a process that is killed is a critical one, and so your system does not recover.

Where you say the server stopped responding, do you mean web response only, or were you trying ssh, or something else? Ping?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.