My Server Is Under Attack!!!

[Raq3iUser]

Hi, I really need help from you guys. For the last two days my server has been under attack. What can I do to find out who it is and how can I stop this non sense?

This is what I get when I ping my server. Maxim doesn't even know how to fix it for me and can't figure out what is causing this. What should I do guys? I am very confused and frustrated. My serve was down for 7 hours yesterday and now it down again. This has never happened before.

C:\WINDOWS>ping 209.25.157.198

Pinging 209.25.157.198 with 32 bytes of data:

Reply from 209.25.128.212: Source quench received.
Reply from 209.25.128.212: Source quench received.
Reply from 209.25.128.212: Source quench received.
Reply from 209.25.128.212: Source quench received.

Ping statistics for 209.25.157.198:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms


Please help me if you have any knowledge of this.

Is this evidence that someone is ICMP Source Quench attacking me???

Max In: 6631.1 kb/s (6.6%) Average In: 5268.5 kb/s (5.3%) Current In:
48.0 b/s (0.0%)
Max Out: 410.6 kb/s (0.4%) Average Out: 296.7 kb/s (0.3%) Current
Out: 7200.0 b/s (0.0%)

Please help me =( Thanks

[gse]

I just pinged your ip and it seems fine now (but I'm on DSL):
10 packets sent; 10 packets received; 0% lost.
Round trip times (ms): Minimum: 92, Maximum: 165, Average: 121
End time 02/11/01 09:39:33
if you are on unix box, telnet and check
netstat -a
This will give you and idea if anyone trying to flood your box. If so, ask your server administrator to block all the packets from the attacker on their firewall. Or even better - find out who their backbone provider and call them and have them block the asshole on their ATM before it even reaches your server - that's the most effective way to my experience.
Good luck.

[Raq3iUser]

Thanks, my server came back up after 5 hours of downtime. I will telnet in and let my PC log the server using netstat -a.

Is that the only way of detect a flood? What does a flood look like in netstat -a? Many Many connections from one IP?

Thanks.