Linux DDoS(?) atacks

[MeNi]

Hi.

Somebody probablly startet atackig my ots few days ago. Some times in a day ots starts lagging like a #%%^$, you can run 1 sqm in 3 min. My server is running on linux debian VPS.

1) How i can detect the method of this atack & ip of atacker(s)?
2) How i can check internet usage on my VPS?
3) How i can protect myself for most known methods of atacks?

I use firewall generated by this site: (Easy Firewall Generator for iptables) - i set there to accept only ftp, 7171, 7172, ssh & www ports and this firewall is probably working, becouse when i turn it on i cannot ping myots.ip.

 

[hans henrik]

what OS do the VPS run?
does it run a grapical system?

oh and it doesn't matter what ports you lock down if the attack is on port 80 or port 7171

 

[beatshif]

don't run with root user

 

[MeNi]

what OS do the VPS run?
does it run a grapical system?

oh and it doesn't matter what ports you lock down if the attack is on port 80 or port 7171

Debian 5.0 Lenny, no grapical, only ssh - i dont know on what ports atack is, i want to check it (look at point 1 of my first post) - i need a command to check internet ussage with shown ip adresses and ports

don't run with root user

I run ots witn non-root user

 

[beatshif]

in that case block some ports through iptables. ;d

 

[MeNi]

@up

i blocked all ports, i left only www, ftp, ssh, and 7171,7172 open with iptables...

Thing what i need is command to check all opened connections with ports and ipadresses, which i can run while i will be under atack to check ip and port of attacker

 

[MeNi]

bump to the top!

 

[MeNi]

bump? aaaaaaaaaaaaa

 

[hans henrik]

guy on irc://irc.freenode.net/debian said
to get some info of tcp-connections/internet bandwidth
lsof -i
and suggested that you'd install (D)DoS-Deflate
(vizzy/markybob #debian)