Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an issue here.

A web application installed on Tomcat (for example) can be configured to use secured http connections only (i.e., https). I am not a sysadmin expert, but I believe that in case of a DDoS attack, the high number of https connections attempts could create 100% CPU spikes.

My questions are:

  1. Do DDoS attacks on https create long 100% CPU spikes?

  2. Is it possible to implement a software filter to monitor requests-per-seconds before the SSL negotiation is started in order to avoid long 100% CPU spikes?

  3. If answer to 2. is yes, can this be integrated in Tomcat? If yes how? Or it there a better solution out there?



If answer to 2. is yes (but not in Tomcat), what solutions are available out there?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

IP addresses cannot be faked in an established TCP/IP connection. – mailq Sep 29 '11 at 12:16
1) Yes. 2) Yes. 3) No. – mailq Sep 29 '11 at 12:18
@mailq Good point about established TCP/IP. You mention yes to 2., do you have suggestions? Thanks. – JVerstry Sep 29 '11 at 12:22
What platform is this? – David Schwartz Sep 29 '11 at 12:25
@David Linux/Ubuntu – JVerstry Sep 29 '11 at 12:29
up vote 1 down vote accepted

Ubuntu's ufw tool has a limit option that limits a service to 6 connections per IP address per 30 seconds. You can also use iptables.

Many of the examples are for limiting ssh, but just changing the port should do it.

share|improve this answer

If you're trying to block attacks look into ConfigServer Security & Firewall. It manages iptables to set up rules to block attacks. It even installs into your WHM automatically (if you're on a WHM system).

Here is where you'll find the free version.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.