Windows server 2008, a very small DDoS is able to kill my server

Question

enter image description here

So I have this i7 3.2Ghz 6-core dedicated server running Windows Server 2008, with a 1Gbps internet speed. Everything runs fine and nice, and the machine is strong enough to handle even up to 700 Mbps DoS attacks very easy.. no lag, no problem..

From time to time we were used to have big attacks but from only 1 or 2 IP at a time, so the CPU usage was always fine, until recently, we discovered a whole new level of DDoS attacks !

Some guy is flooding very small SYN packets, that are not exceeding 40 Mbps in total, but from thousand of IPs/botnets.. He is able to increase the CPU usage of the first COR up to its maximum, making the server almost down and not responding to RDP.. (The other 11 cors are empty, just chilling)

The TCP port that the attacker is targeting is a closed port, i think it's just the OS (Kernel in red) that's making all that mess.

I did some research, and (not sure) I think maybe the problem is something about IRQ balancing, like I need to balance that CPU usage between the other free cores..

Anyways, the big question is: Is it possible to fix this issue within the windows itself? How the hell can he kill my server with a 4% Network usage, when my server was able to stay alive even at 90% of the network usage before?! There must be a fix to this! Anyone know about balancing the 1st core to fix this? Please help with anything you have.

enter image description here

@Chopper3 It's a big hosting company that provides i7 as dedicated servers, why do you think it's bad ? — Reacen, May 09 '13 at 16:52
@Reacen it's a desktop CPU, missing a lot of the RRAS features of the Xeon or Opteron chips, i7's are good value but I care too much about uptime to risk using one, but that's a budget thing I guess. — Chopper3, May 09 '13 at 21:40

score 4 · Answer 1 · answered May 09 '13 at 17:15

A proper firewall in front of your Windows server will take care of that.

Failing that, you need to adjust your interrupt routing to distribute the interrupts to more cores. Here's an example of what it looks like before and after enabling said distribution (red line is a single core handling all the interrupts):

You can use RW Everything to modify the PCIe router configuration space if you know what to twiddle. Contact your server vendor to learn more.

Windows server 2008, a very small DDoS is able to kill my server

1 Answers1