Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm pretty sure I was under Slowloris attack. I set up an iptables rule to limit max connections to my webserver, but I'd like to know how I can figure out if it really was a Slowloris attack, and if so, how I can find the IP address of the attacker. I'd really like to pass the logs on to his ISP.

Thanks

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Slowloris attacks work by sending request data as slow as possible. Therefore, if you could measure the bandwidth use per ip address then if it's below some threshold, (found by measuring the bandwidth in a known slowloris attack) then you know you are under attack.

To prevent attacks, I'd suggest switching your webserver software. I use cherokee which is resistant in it's default configuration. I can't ascertain whether nginx is vulnerable, but lighttpd is. I also can't be sure that using a resistant webserver as a proxy will make any difference.

Here's more information: http://ha.ckers.org/blog/20090617/slowloris-http-dos/

share|improve this answer

Level 1 : simple slowloris DOS


to find the ip address of the slowloris attack i use the following command line :

netstat -ntu -4 -6 |  awk '/^tcp/{ print $5 }' | sed -r 's/:[0-9]+$//' |  sort | uniq -c | sort -n

this will give you the number of active connections for each connected IP

if you are under a simple DOS attack, a kiddie with one or a few IPs , the one with 50-100 connections ( or more ) is most probably a slowloris attacker you can drop

if its a real ddos with thousands of IPs that wont help much

Level 2 : real big slowloris DDOS


netstat ( #watch netstat ) can still help you see some IPs are just always connected

to fight slowloris, on apache, install the reqtimeout modules and set it up, example :

http://pastebin.com/3BNNwfyb

after that, every 408 you see in access_log is 99.999% sure a slowloris attacker ip.

can easily stand up against thousands of ip and thousands packets/second on a decent dedicated server

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.