How to Stop a DDoS Attack In Progress

Block Unwanted Traffic With Cloudflare

We had an issue with DDoS attacks a few years ago. We ended up getting Cloudflare to help protect us from these attacks.

Cloudflare sits between the outside internet and our server.

All the traffic gets routed through Cloudflare and it can choose what traffic goes to our site and what traffic gets blocked. We only sell online to the United States through Cloudflare. We have blocked all the countries where these DDoS attacks tend to originate from. Between blocking outside countries and Cloudflare DDoS protection, we haven’t had any attacks in the past 3 years.

Diffuse Attacks With Anycast Networking

Anycast network diffusion can scatter traffic. Once you identify a DDoS attack and are sure it is not simply high traffic from multiple sources, using an Anycast network can disperse the attacking traffic by spreading it across a network of servers. This spreads out the traffic to the point that it can become absorbed by the network and become more manageable. Separating the volume of attacks can save your server.

Know Your Normal Traffic Patterns to Help You Act Promptly

You have to be able to identify when you’re under attack, especially if you have your own servers. The idea is to establish those DDoS problems sooner than later with your website, so you can stop the attack. It’s always a good idea to know what your typical inbound traffic looks like. When you’ve pinpointed its normal behavior, you’ll have it easier to spot any changes, since most DDoS attacks look like sharp spikes in traffic.

Configure Firewalls to Block suspected IP Addresses

A distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to users. It is achieved by flooding the target with requests from multiple sources, overwhelming it with traffic and making it difficult or impossible to respond to legitimate requests. DDoS attacks can be very difficult to stop once they are underway, but there are some steps that can be taken to mitigate the effects.

One way to stop a DDoS attack in progress is to block the IP addresses that are generating the illegitimate traffic.

This can be done by configuring firewalls and other network security appliances. Additionally, it is important to have backups of critical data and systems so that they can be quickly restored in the event of an outage. By taking these precautions, you can help to protect your network from the devastating effects of a DDoS attack.

Get Help From Your Internet Service Provider

Not all DDOS attacks are the same. While there are some ways to mitigate an attack in progress, depending on the type of attack it is. The most comprehensive way to deal with a DDOS attack is to get help. Rather than guessing after what sort of attack you have, contact your ISP and ask them to block the sources or re-route the incoming traffic. This process could take a bit of time, so the sooner you do it, the better. While there are other methods to mitigating an in-progress DDOS, your best ally is going to be your service provider. While you may feel like you want  to fight back when you’re under a DDOS attack, it’s better to call in the professionals and let them sort things out.

Rate-Limit Your Router to Restrict Incoming Traffic

Distributed denial-of-service (DDoS) attacks are harder to repel than normal denial-of-service (DoS) malware. The reason is simple, DDoS uses many sources to flood your system. In comparison, typical DoS relies on a single system. DDoS spoofing stems from many systems, so tracking the source in time is tough. You should focus on defending your end instead. Rate limiting your router will restrict the traffic that reaches your server. Less traffic will save your server from getting overwhelmed. Rate limiting is easier for companies that use dedicated servers. You can also contact your ISP and ask them for help because it’s their router. 

Limiting your router will also prevent regular traffic from reaching your server. So, always use it as an extreme resort. And remember, rate limiting will not help you root out the source of the attack. It will only help you mitigate the damage. So, after the attack passes, trace the origin and block it.

Terkel creates community-driven content featuring expert insights. Sign up at terkel.io to answer questions and get published.