Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an issue here.

A web application installed on Tomcat (for example) can be configured to use secured http connections only (i.e., https). I am not a sysadmin expert, but I believe that in case of a DDoS attack, the high number of https connections attempts could create 100% CPU spikes.

My questions are:

  1. Do DDoS attacks on https create long 100% CPU spikes?

  2. Is it possible to implement a software filter to monitor requests-per-seconds before the SSL negotiation is started in order to avoid long 100% CPU spikes?

  3. If answer to 2. is yes, can this be integrated in Tomcat? If yes how? Or it there a better solution out there?

Thanks.

EDIT

If answer to 2. is yes (but not in Tomcat), what solutions are available out there?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
IP addresses cannot be faked in an established TCP/IP connection. –  mailq Sep 29 '11 at 12:16
1  
1) Yes. 2) Yes. 3) No. –  mailq Sep 29 '11 at 12:18
    
@mailq Good point about established TCP/IP. You mention yes to 2., do you have suggestions? Thanks. –  JVerstry Sep 29 '11 at 12:22
    
What platform is this? –  David Schwartz Sep 29 '11 at 12:25
    
@David Linux/Ubuntu –  JVerstry Sep 29 '11 at 12:29

2 Answers 2

up vote 1 down vote accepted

Ubuntu's ufw tool has a limit option that limits a service to 6 connections per IP address per 30 seconds. You can also use iptables.

Many of the examples are for limiting ssh, but just changing the port should do it.

share|improve this answer

If you're trying to block attacks look into ConfigServer Security & Firewall. It manages iptables to set up rules to block attacks. It even installs into your WHM automatically (if you're on a WHM system).

Here is where you'll find the free version.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.