Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm pretty sure I was under Slowloris attack. I set up an iptables rule to limit max connections to my webserver, but I'd like to know how I can figure out if it really was a Slowloris attack, and if so, how I can find the IP address of the attacker. I'd really like to pass the logs on to his ISP.

Thanks

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Slowloris attacks work by sending request data as slow as possible. Therefore, if you could measure the bandwidth use per ip address then if it's below some threshold, (found by measuring the bandwidth in a known slowloris attack) then you know you are under attack.

To prevent attacks, I'd suggest switching your webserver software. I use cherokee which is resistant in it's default configuration. I can't ascertain whether nginx is vulnerable, but lighttpd is. I also can't be sure that using a resistant webserver as a proxy will make any difference.

Here's more information: http://ha.ckers.org/blog/20090617/slowloris-http-dos/

share|improve this answer

to find the ip address of the slowloris attack i use the following command line :

netstat -ntu | awk '{ if($1 == "tcp" || $1 == "tcp6") { print $5 } }' | sed -r 's/:[0-9]+$//' |  sort | uniq -c | sort -n

this will give you the number of active connections for each connected IP

the one with 50-100 connections ( or more ) is most probably a slowloris attacker you can drop

share|improve this answer

Please update your Apache to the latest version which is not affected by Slowloris. Iptables won't protect you since the attack is not about high request rate at all.

Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they'll allow. Slowloris must wait for all the sockets to become available before it's successful at consuming them, so if it's a high traffic website, it may take a while for the site to free up it's sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris.

share|improve this answer
    
If you reduce the amount of maximum connections a single user can have, they can't tie up all the sockets. –  Rob Dec 26 '10 at 13:30
    
My understanding is that by time they can use all your resources with low amount of connections. And few IPs are enough. Better if you test it than make an assumption. –  Istvan Dec 26 '10 at 13:36
    
No, generally speaking it takes a few hundred connections for slowloris to work, depending on your apache settings. Aside from that, I don't see anywhere where the latest Apache is unaffected by Slowloris. I'm running Apache 2.2 –  Rob Dec 26 '10 at 13:39
    
Well I though Apache fixed this long time ago, but it seems this is not the case. I am using nginx as the frontend for apache so this is how i mitigated this stupid bug. –  Istvan Dec 26 '10 at 13:54
    
Ah. So, any idea on how to find the evidence for this attack? –  Rob Dec 26 '10 at 13:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.