Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i know about the question : How can I detect Slowloris?

but that does not apply.

Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in the last days some attempts of SlowLoris DoS , in fact didnt work because my team reduced the amount of conections and timeouts per IP and it worked plus the load balancer helped but, i have all that info in .zip each zip with 30mb , and in more then hundreds of .zip files that contain the .pcap files ... can anyone tell me if there is a effective way of searching for all that .pcap files for ips with certain amount of bandwith or for example with more then 40 or 30 ip conections to my server ? like a one liner or a tcpdump command for each file maybe.

share|improve this question
    
How do you know there was a Slow Loris attack if you don't know how to detect Slow Loris attacks? –  Ladadadada Jul 10 '13 at 21:16
    
That is easy , i got operations ( Command and control and Sys admins ) with 2 main servers on exausthion and i got scanners from our partners giving the information that we were vulnerable to slowloris , and i know it was because our ids reported the situation but it keeps low amount of log's for the time being and i was out .. of office now i would like to make the incident investigation. –  drd0sp.pt Jul 10 '13 at 22:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.