How to tell if your being ddosed??

[DJ 2501]

I have a home web server. I got up this morning to discover my servers hdd is working about every second. I though thats weird I dont have any sites on the server yet. So I look down at my dsl modem and the activity light is flashing everytime my hdd makes the "im thinking" noice.

I know it wasnt other computers in my network using the internet because I only have one other comp and it was off, plus the internet light was in sync with the servers hdd light.

Is there a way in centos to see if i was being attacked in anyway?

I rebooted the server and everything stopped.

[sheryco]

Try these commands.
#netstat -anp | grep :80
or
#tcpdump (man tcpdump)
or you even check your access logs and see if whoever is accessing the server is from the same IPADDR or if the logs all look similar.

[Roxoff]

A distributed denial of service attack would not stop because you did a reboot - it would carry on. The multiple clients connecting as fast as they can to your server would get a few timeouts while you did a reboot, then it would be back to normal.

It's more likely that you had something running on the server that didn't terminate cleanly or you may have a wayward script doing something unusual. Whatever it was, it seems to have been inside the lan (including on the server) not outside.