Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; nginx is taking 10 minutes to finish the responses to these requests! But why? I can't understand why. I can't even figure out why I can't stop it.

I've got these set:

    client_header_timeout 5;
    client_body_timeout 5;
    keepalive_timeout 5 30;
    send_timeout 5;

So should it not be timing out after 5 seconds? Why does it continue to 600 seconds or more? Is there a way I can figure out what type of attack this is? Slow header? Slow POST? How can I detect what this attack is and how can I stop it?

It should also be noted that the connections are passing through a load balancer and a Squid Cache reverse proxy, so the only way I can read the clients' true IP is through specific HTTP headers

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 22:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Did you analyze Nginx's error.log ? – Alexander Azarov Feb 27 '12 at 11:27

It will be hard to figure it out like this; I would suggest a full packet tcpdump of one of DDoS sources and then analyze what he is doing in wireshark or some other tool for inspecting captured data.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.