Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.

learn more… | top users | synonyms

2
votes
1answer
697 views

What does enable DoS protection in Synology DSM 5 do?

If I open Control Panel > Security > Protection, check Enable DoS Protection and click Apply, what kind of traffic gets blocked? The text reads "Denial-of-Service (DoS) protection helps to prevent ...
1
vote
1answer
661 views

Kali SYN Flood (Metasploit), not denying service

I have a server with apache2 installed. I tried to do a dos attack on the server by using kali linux syn flood attack, but i am still able to access the website on the server. msf auxiliary(synflood) ...
4
votes
1answer
110 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. ...
0
votes
0answers
109 views

Is Jetty immune to Slow HTTP Denial of Service attacks (e.g., slowloris)?

After a security scan, our webserver was found to be vulnerable to "slow HTTP denial of service" attacks. We are currently on an older version of Jetty (6.1.22). I'm not sure if the scan actually ...
1
vote
2answers
414 views

trustwave pci scan: dns amplification denial of service, Bind 9.8.1-P1, doesn't seem like it

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service". Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: ...
0
votes
0answers
25 views

Intelligently filtering bogus query strings

A vBulletin site I maintain is on the wrong end of a DoS attack which is inexplicably routing through CloudFlare unimpeded by their DoS protection. The requests look like this: 1 /?ZZZZCQG=XJXAUD ...
-3
votes
1answer
403 views

Acunetix surfaces a Slow HTTP vulnerability, how do I protect against slowloris?

How to protect from slowloris ? I have installed mod_antiloris and mod_qos and acunetix still warn about slowloris. mod_antiloris and mod_qos are loaded Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 ...
1
vote
0answers
233 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
0
votes
3answers
248 views

How to protect server from simple DoS attack

Please note I am NOT asking how to protect server from DDoS. What I mean is that if someone runs siege -c 1000 www.example.com on his VPS. That will result in my server serving thousands of requests ...
-2
votes
1answer
578 views

Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]

The site is a simple penny auction site. The site runs on: MySQL PHP At any given time: an auction can have 100 - 2000 concurrent users. each user has one single "long poll" running in the ...
1
vote
0answers
72 views

Cause for large number of duplicate web requests

I am seeing odd traffic to my web site. On occasion, probably a few times a day, I will get a flurry of requests for the same URI from the same IP address for several minutes, at rates from maybe one ...
0
votes
1answer
53 views

Under DoS, how to alter MediaWiki to reject quickly any editing and history requests for anonymous users

One of our MediaWiki - based projects seems under DoS attack - unusual number of anonymous users try to edit pages and view or edit history requests. While anonymous editing is disabled on that ...
1
vote
0answers
85 views

Preventing NFS Denial of Service

I have a NFS4 server running Ubuntu 10.04 Server, on an enterprise environment with 50+ clients. Overall, everything works fine, but from time to time, some client starts making +1000 NFS operations ...
0
votes
3answers
520 views

Is this a denial of service attack?

I have my kern.log flooded by these lines: Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 ...
11
votes
4answers
8k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
8
votes
2answers
1k views

Linux: prevent outgoing TCP flood

I run several hundred webservers behind loadbalancers, hosting many different sites with a plethora of applications (of which I have no control). About once every month, one of the sites gets hacked ...
0
votes
4answers
2k views

apache being flooded?

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. ...
5
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
4
votes
2answers
290 views

Tomcat Denial of Service due to large packets

I had asked this question on ITSecurity, but I felt this question is better placed here. On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
1
vote
2answers
245 views

Block packets based on length

Can I block packets (Specifically UDP) that are > X length? I am getting attacked exclusively by UDP packets that are very large in size from a large number of IP Addresses. I have a legitimate use ...
1
vote
3answers
774 views

ESXi server under DoS attack, can I use SSH to determine where from? [duplicate]

My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host. I ...
0
votes
1answer
3k views

DNS Server being used for Amplified DNS Attack - ripe.net

We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the ...
-2
votes
4answers
395 views

Getting attacked, what do I do? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm getting millions of these requests in my Apache access log. How do I stop them? 173.59.227.11 - - [30/May/2012:18:23:45 -0400] ...
3
votes
1answer
176 views

Buffer-stuffing denial-of-service attack

I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
4
votes
3answers
911 views

Excessive Outbound DNS Traffic

I have a VPS system which I have had for 3 years on one host without issue. Recently, the host started sending an extreme amount of outbound DNS traffic to 31.193.132.138. Due to the way that Linode ...
1
vote
5answers
678 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
3answers
1k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
6
votes
2answers
1k views

Prioritise ssh logins (nice)

Is there a preferred way to set "nice" for sshd? I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
1
vote
2answers
3k views

Kernel Printk: xx message suppressed

Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
2answers
116 views

Resolving a prolonged DDoS [duplicate]

I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
1answer
548 views

DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response

In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-4
votes
1answer
339 views

Wich module to defend my apache server?

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
3
votes
2answers
1k views

Apache SSL Renogotiation (thc-ssl-dos)

Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled. I have been checking a few servers and have the following questions; First; renegotiations are disabled by ...
2
votes
1answer
2k views

nginx: Prevent DoS by limiting worker processes/connections

If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable? Basically, I'm trying to secure my ...
2
votes
2answers
204 views

How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned ...
2
votes
4answers
1k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a ...
1
vote
1answer
379 views

Apache's built-in anti-dos mechanism by returning code 403?

In the process of learning more about how to survive simple DoS attack for my Apache server, I found some script to initiate attack on my own server and I notice that Apache returns error code 403 ...
3
votes
2answers
870 views

iptables rate-limit module problem

I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks). In my rules I have something like: ...
2
votes
1answer
387 views

Where can I find DoS attack simulator [closed]

I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc... Could someone please ...
1
vote
1answer
147 views

Is it normal to collapse VPS CPU with this script?

This is the script, it comes with mod_evasive: #!/usr/bin/perl #test.pl: small script to test mod_dosevasive's effectiveness use IO::Socket; use strict; for(0..100) { my($response); ...
0
votes
2answers
145 views

defend dos attack

my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second. Is there a way to defend this kind of attack? Is there a way to trace back to the ...
0
votes
2answers
229 views

iptables logs but doesn't drop packets

I am trying to create some simple iptables DOS protection rules for my web server. I was doing testing on the following rules: iptables -N LOGDROP > /dev/null 2> /dev/null iptables -F LOGDROP ...
1
vote
1answer
87 views

Can't figure out this attack, getting botnets and something else

About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out. My site is not ...
2
votes
2answers
793 views

Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log

I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
3
votes
2answers
132 views

In what way am I more likely to be DDoS'd? Via http or other ports? [duplicate]

I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena. The service will consist of: a ...
3
votes
3answers
7k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
1
vote
3answers
186 views

Apache relaying to prevent DoS

I've been wondering, is there a technology that relays (slows down) responses to a given IP according to the rate It makes requests? E.g I have an apache server with a "heavy" API service that I want ...
1
vote
1answer
75 views

What is idea of web server attack on thinker/js/think.js?

My web server is getting a lot of GET request on thinker/js/think.js and thinker/showSimilarInfo.do. These requests obviously constitute a server attacks. What is point of these attacks? Also, ...
7
votes
2answers
2k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
5
votes
5answers
1k views

Ec2 Denial of Service: Securing cloud based website from DOS attack

How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy