Oddities after http post flood dos?

Question

DDoS Protection

Today my server was attacked by the type of a subject. So the attack passed, but something incomprehensible is happening with the server, only 100 ip and subnets got into iptables, parasitic traffic decreased by 20 times. There is no load on the server either on nginx or on apache or on the disk or on the CPU. However, the server's ip suddenly became unavailable all over the world (could not establish a connection), the ping was terrible, most often 100% loss. Hosting comrades are still figuring out why it is unavailable. Now the sites are opening, but pictures and other resources are loaded with a huge delay of 1 second or more, while there is no load on nginx. What is it? Where to look? And how could it have had such an impact?

Answer 1

look in netstat -n.
Most likely they switched to a UDP attack (they are trying to block the server's external channel).
As an option - a slow attack, when you are hammered with very slow requests (they appear in the logs only when they end) and clog the network stack.