The site is a simple penny auction site.
The site runs on:
At any given time:
- an auction can have 100 - 2000 concurrent users.
- each user has one single "long poll" running in the background that keeps their display updated
- a user can open multiple windows, increasing the number of "long poll" requests to how many ever windows they have open
It's safe to say that a user should:
- Never have more than about 3 to 5 windows open
- Never request pages, images or basically do any get requests too frequently
- Never call the long poll update function more than once a second per window (at most, but due to the logic, usually far less)
Based on the above what would you recommend to stop any Denial of Service attacks?
So far, when it comes to Denial of Service, I'm aware of the following:
Which would you recommend and why? Or is perhaps a combination necessary?
With caching I'm already making use of MemCache, but is there perhaps caching I can enable on a web server level? The goal is to bring the load on the server down to an absolute minimal, which means even users requesting images or css files repeatedly should be stopped?
Ideally I want a user that abuses the set of rules I create to get a 403 forbidden response which must have a tailored page which tells him why he is temporarily banned. Which also means that if a user breaks these rules, he must not be permanently banned, but rather be blocked for 10 minutes.
Also, one of my biggest concerns is per-IP blocking. Technically I could create a block on a PHP level, but if several users have the same IP, as is the case with a university or office block, how can I stop the group from being blocked if one guy is breaking the rules? The inverse is also true: what if one guy manages to get thousands of IPs and hit the server as hard as he can... how do I detect that?
Any advice on how to do this would be greatly appreciated!