Tracing denial of service attack

[scaramanga]

Does anyone have any experience of tracing a denial of service attack?

A user on Orange home broadband hit a web site I wrote for my local football team with hundreds of thousands of requests in a short period last week. Pleasingly the bits of the web site which I wrote stood firm but I had a Gallery PHP application installed which started maxing out the CPU on my shared host so the hosting company disabled my account while I looked into it.

Anyway I found out the user's broadband address from the server access logs (blahblahblah.orangehomedsl.co.uk). I don't know very much about this sort of stuff so I guess I'd be interested to know whether this is actually useful (i.e. presumably someone could fake it but if so I'd expect some sort of proxy server and not what looks like a normal broadband connection?)

I emailed the Orange abuse department who told me they can't do anything without the IP address. This strikes me as unhelpful as I would have thought they could work out who was using the connection in question as I have told them the exact time the attack occurred (and it was over a period of hours). So if anyone can tell me they are talking nonsense and a constructive reason as to why, I can go back to them with abuse of my own.

I have asked the host if they can supply the IP but suspect they probably don't have anything more than I have got from the apache access log which has the address in this long format. I've asked them to change the format of the logs so the IP can be captured in the future but obviously this doesn't help with this case.

TIA for any suggestions.

[AtW]

Most likely you won't trace anything as these days compromised PCs are used for such attacks.

[TheRefactornator]

To attempt to find the IP you could:

1) Do a DNS lookup to find the IP of blahblahblah.orangehomedsl.co.uk (or whatever it is) as it is assigned now, but obviously this will not tell you the IP address that was assigned at the time of the attack..if the hostname was spoofed, so this might not help..
2) If you use Google Analytics on the site have a look at your account around the time of the attack because the IP will be in there.

..sorry that's all I can think of if your apache log is really that limited. I tend to implement my own web site access statistical data logging to a rolling 7 day data table in a SQL db on my shared hosting account logging stuff like IP, hostname, geolocation, browser, OS etc..

It does sound like Orange are being very unhelpful..is the abuse department outsourced? I reckon they could run a trace and find the IP if they really wanted to, but actually finding someone internal at Orange who is willing and able to do this..and if in the end if you did find the culprit IP / computer, it's likely to be consigned to being the result of a virus on that box.

[scaramanga]

Thanks guys, sounds like it is not going to be possible to trace but I will look into Google Analytics for the future.

[AtW]

The attackers who can mount DDoS from compromised zombie PCs ain't going to be stupid enough to browse your site from their own IP - they'll use same botnet to proxy requests through.

The police ain't interested unless you are a big company with deep pockets, and even in this case they won't do much if its cross border attack which it most likely is simple because of geography of compromised PCs.

Basically if you are being DDoSed your only salvation is deep pockets to pay provider to deal with this problem.

[pmeswani]

Time to invest in a firewall that does IDS/IPS at the gateway. The club should dish out about £200 to £400 in a product like a Sonicwall TZ180. However, if the website is not important enough, then it would be worth saving the money for paying some footballer's wages.