How to diagnose a DoS/DDoS attack and find websites under attack on a Plesk server?

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are serious threats to any server, including those running Plesk. These attacks can cause significant disruption to your services by overwhelming the server with excessive traffic, rendering websites slow or completely unavailable. Detecting and mitigating these attacks in real time is crucial for minimizing the damage. In this guide, we’ll walk through how to diagnose a DoS/DDoS attack and identify affected websites on a Plesk server, both for Linux and Windows environments.

Real-Time Attack Diagnosis on a Linux Server

1. Connect to the Server via SSH

To begin investigating the attack, you’ll need SSH access to the server. Use the following command to connect:

Once connected, you can begin diagnosing the attack.

2. Determine the Source IP Addresses and Number of Connections

The first step is to identify the IP addresses generating excessive traffic. This can be done by checking the number of connections established on ports 80 (HTTP) and 443 (HTTPS).

Run the following command:

This command will show you the IPs that have established connections to the server on the HTTP and HTTPS ports, sorted by the number of connections.

3. Identify the Domains Under Attack

To determine which websites are being targeted, you can check the access logs for recent connections. Run the following script to search through access logs of all domains:

Replace 203.0.113.2 with the suspected attacker's IP. This will help identify which domains are receiving the most requests from that specific IP.

4. Check for SYN Floods

SYN flood attacks are a common form of DoS attack where the server’s resources are exhausted by incomplete TCP connection requests. To check for this, run:

This command shows the number of connections in the SYN_RECV state, which can indicate a possible SYN flood attack.

5. Identify the Target IP Address Under Attack

If the server is under attack, there may not be many established connections to the web server, but there might be a large number of requests that Apache or Nginx is processing. To pinpoint the target, use the following command:

This will identify the most common target IP addresses under attack.

6. Track Requests Processed by Apache and Nginx

Requests may be getting handled by Nginx before reaching Apache. To track the number of requests served by Nginx, navigate to the /var/www/vhosts/system directory:

Generate a file that logs the number of requests in the last hour:

Replace 24/Jan/2022:20 with the timestamp you want to track.

To view the requests, run:

This will show the domains with the highest number of requests in the last hour, helping you identify the most targeted websites.

Finished Attack Diagnosis on a Linux Server

If you are investigating a completed attack, you’ll need to gather and analyze logs over the last few days.

1. Set Up an Investigation Environment

Create a directory for storing investigation files:

mkdir /root/inv

Next, go to the /var/www/vhosts/system directory and create directories for each domain:

2. Copy Relevant Logs

Copy logs from the last few days into your investigation environment:

3. Unzip Log Files

If the logs are compressed, unzip them for easier access:

4. Remove Irrelevant Files

Delete unnecessary configuration and statistic files to focus on the logs:

5. Extract Logs from the Day of the Attack

To focus on the attack period, extract log entries from the day of the attack. For example, if the attack occurred on October 30, 2017:

6. Analyze Log Files by Size

To find the most targeted websites, sort the log files by size:

Larger log files indicate more requests during the attack.

7. Identify the Most Frequent IP Addresses

To see which IPs made the most requests, use the following command:

This will help identify the IP addresses involved in the attack.

8. Find the Domains Targeted by Specific IPs

Finally, you can identify which domains were targeted by each IP:

Real-Time Attack Diagnosis on a Windows Server

For Windows servers, diagnosing a DoS/DDoS attack is straightforward using built-in tools.

1. Connect to the Server via RDP

Use Remote Desktop Protocol (RDP) to connect to your Windows server.

2. Check the Number of Connections on Ports 80 and 443

Open the Command Prompt and run the following commands to check for a high number of connections to HTTP (port 80) and HTTPS (port 443):

If you see hundreds or thousands of connections to these ports, the server is likely under a DDoS attack.

Conclusion

Diagnosing a DoS/DDoS attack on a Plesk server requires a combination of monitoring server load, analyzing logs, and checking network traffic. By using the tools and techniques described in this guide, you can identify which websites are under attack and take the necessary steps to mitigate the attack. Remember to regularly monitor traffic, implement security measures like firewalls, and consider third-party DDoS protection services to prevent future attacks.