[blackps]

00:52:17.010647 IP wpc0688.host7x24.com.17206 > my doamin.domain: [|domain]

how do i protect from this ddos please?

[anomie]

So we're looking at tcpdump output here, right? This looks a lot like a packet from a name resolution request. What makes you think this is a ddos attack?

[MikeTbob]

If you were under Ddos attack, I don't think you would be able to post onto the forums for help either.

[blackps]

it's a dos attack allright,how can i block a ddos attack as iptables not good for this or apf or csf please help

[RobinVossen]

If its a real DDos You should give a TCP Dump. Dump File.
And then we can see who DDOSED.
Then you should contact one of those IP's saying that they are DDOSing and tell them that you can get the Bot that does that.
Get the bot, Disassemble it.
Go to the IRC Channel that he uses to Control his Bots.
And have a convo with him.

Cheers,
Robin

[anomie]

Originally Posted by blackps

it's a dos attack allright,how can i block a ddos attack as iptables not good for this or apf or csf please help

More information would be better if you want some help. You haven't described the service you provide that is getting hammered, or any of the symptoms of the problem.