I run a small Web server. It's a vanity project, very low traffic - less than 50 pages served per day. Strictly HTML - no CGI, no PHP, nothing. For the past couple of weeks the server has been the target of a SYN Flood attack. Also very low volume - 100-150 SYN packets (with forged IP addresses) received per hour. I have all the usual mitigations in place and the attack is not affecting the server. However, I am curious why it's being attacked. I have not received any "ransom" email, the server does not host anything that is even mildly controversial and the forged IP addresses are always different and from all over the world so I'm not being used to flood some other server. Can anyone suggest a purpose for this attack?
Ask HN: Why is my web server being attacked?
1–10 of 48 posts
Re: Ask HN: Why is my web server being attacked?
#2It's on the Internet. That's the only reason.
Re: Ask HN: Why is my web server being attacked?
#3Testing your defenses?
Re: Ask HN: Why is my web server being attacked?
#4Clear context is missing: what are you hosting, what webserver, who are you - person of interest?, what is your IP, hosted on a cloud service or too cheap vps? , what is your dns? And most important: what is behind your front door…
Re: Ask HN: Why is my web server being attacked?
#5Probably because the attackers can. Sometimes people don't need a deep reason for doing anything. They just want to watch bits of the web burn.
Re: Ask HN: Why is my web server being attacked?
#6> 100-150 SYN packets (with forged IP addresses) received per hour.
Lol. That's not an "attack."
Your server is publicy accessible over the internet. This means you are explicitly allowing other networks to connect to your server. This is par for the course; just always make sure to run the latest security patches and move on with life.
Re: Ask HN: Why is my web server being attacked?
#7I don't think I'd consider 100 SYN packets per hour to be an attempted SYN flood attack
Re: Ask HN: Why is my web server being attacked?
#8One hundred. Not great, not terrible.
Take him to the infirmary. Toptunov, take him! He's delusional. Flood attack, forged IP addresses. He'll be fine. I've seen worse.
You didn't see forged IPs. You didn't. You didn't!!! Because it's not there!
Re: Ask HN: Why is my web server being attacked?
#9Adding to what has already been said-
New registrations are the food for probing.
You could have an IP on someone's naughty list from a previous user.
It's any other day on the internet.
That's just what the neighborhood ( the whole internet ) looks like from the sidewalk.
So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.
Re: Ask HN: Why is my web server being attacked?
#10Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.
Please don't do this, find another way. Almost 1/2 the internet is inaccessible to me at this point because at some point CF decided that I was a bad actor and now I can't get to anything.