3 ms·
I'll assume that, because rebooting fixed it, this wasn't a pure traffic problem, but just a general system overload issue. You might want to (1) collect traffi
by namibj 6y ago
I'll assume that, because rebooting fixed it, this wasn't a pure traffic problem, but just a general system overload issue. You might want to (1) collect traffic origin statistics and (2) take a good look at some more efficient mail-reception servers (I don't think your outbound SMTP server was hit by DDoS).
- gramakri 6y agoExactly this. If a reboot fixed it, it's probably not ddos
- dvfjsdhgfv 6y agoAnd probably rebooting the whole server wasn't necessary, just restarting the MTA would probably do it. When I was younger and had plenty of time, I'd spend hours or even days diagnosing the root case. These days, I'd just add one line to crontab and moved on.
- toast0 6y agoAgree that if reboot fixes it, it's probably not DDoS. In that case, start by limiting simultaneous inbound connection counts to something reasonable and add alerting so you can inspect the system when you hit the limit. Honestly, I'd start with a limit of 100, and go from there. If connections just sit idle, put a timeout. If they send a lot of garbage, close and ban that IP for a day, etc. I've seen a lot of volumetric DDoS against servers I ran, but they never targeted our mail server. (Yeah, we just had one, but it was just doing autoreplies and forwarding)