Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.
-2
votes
1answer
54 views
Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]
The site is a simple penny auction site.
The site runs on:
MySQL
PHP
At any given time:
an auction can have 100 - 2000 concurrent users.
each user has one single "long poll" running in the ...
0
votes
0answers
169 views
Reduce DNS responses to eliminate DNS abuse [closed]
Imagine that you are a DNS server, and I ask you a question then,
if you are polite, you answer that question.
If I ask you that question again, you will probably give me
a shorter answer.
If I ask ...
0
votes
0answers
33 views
Cause for large number of duplicate web requests
I am seeing odd traffic to my web site. On occasion, probably a few times a day, I will get a flurry of requests for the same URI from the same IP address for several minutes, at rates from maybe one ...
0
votes
0answers
34 views
Under DoS, how to alter MediaWiki to reject quickly any editing and history requests for anonymous users
One of our MediaWiki - based projects seems under DoS attack - unusual number of anonymous users try to edit pages and view or edit history requests. While anonymous editing is disabled on that ...
1
vote
0answers
46 views
Preventing NFS Denial of Service
I have a NFS4 server running Ubuntu 10.04 Server, on an enterprise environment with 50+ clients.
Overall, everything works fine, but from time to time, some client starts making +1000 NFS operations ...
0
votes
3answers
176 views
Is this a denial of service attack?
I have my kern.log flooded by these lines:
Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 ...
11
votes
3answers
734 views
Any reason not to enable DoS Defense in my router?
I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
4
votes
2answers
171 views
Tomcat Denial of Service due to large packets
I had asked this question on ITSecurity, but I felt this question is better placed here.
On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
1
vote
2answers
149 views
Block packets based on length
Can I block packets (Specifically UDP) that are > X length? I am getting attacked exclusively by UDP packets that are very large in size from a large number of IP Addresses. I have a legitimate use ...
1
vote
3answers
421 views
ESXi server under DoS attack, can I use SSH to determine where from?
My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host.
I ...
0
votes
1answer
2k views
DNS Server being used for Amplified DNS Attack - ripe.net
We have a small secondary DNS server running on our office ADSL. However, it is currently getting hundreds of requests a second for ripe.net, which is saturating our connection. From reading on the ...
-2
votes
4answers
289 views
Getting attacked, what do I do? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I'm getting millions of these requests in my Apache access log. How do I stop them?
173.59.227.11 - - [30/May/2012:18:23:45 -0400] ...
2
votes
0answers
115 views
Buffer-stuffing denial-of-service attack
I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
2
votes
2answers
376 views
Prioritise ssh logins (nice)
Is there a preferred way to set "nice" for sshd?
I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
1
vote
2answers
780 views
Kernel Printk: xx message suppressed
Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
2
votes
2answers
110 views
Resolving a prolonged DDoS
I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
1
vote
1answer
334 views
DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response
In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-4
votes
1answer
194 views
Wich module to defend my apache server?
Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack?
Server version: Apache/2.2.17 (Win32)
...
2
votes
2answers
822 views
Apache SSL Renogotiation (thc-ssl-dos)
Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled.
I have been checking a few servers and have the following questions;
First; renegotiations are disabled by ...
0
votes
1answer
1k views
nginx: Prevent DoS by limiting worker processes/connections
If I limit my nginx worker processes to 1 and allow for 500 connections, what happens if I exceed this limit? Does the server return a 503 Service Unavailable?
Basically, I'm trying to secure my ...
2
votes
2answers
116 views
How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned ...
2
votes
4answers
518 views
Tomcat denial of service
The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a ...
1
vote
1answer
269 views
Apache's built-in anti-dos mechanism by returning code 403?
In the process of learning more about how to survive simple DoS attack for my Apache server, I found some script to initiate attack on my own server and I notice that Apache returns error code 403 ...
3
votes
2answers
465 views
iptables rate-limit module problem
I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks).
In my rules I have something like:
...
2
votes
1answer
243 views
Where can I find DoS attack simulator [closed]
I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc...
Could someone please ...
1
vote
1answer
114 views
Is it normal to collapse VPS CPU with this script?
This is the script, it comes with mod_evasive:
#!/usr/bin/perl
#test.pl: small script to test mod_dosevasive's effectiveness
use IO::Socket;
use strict;
for(0..100) {
my($response);
...
0
votes
2answers
129 views
defend dos attack
my website is crippled due to simple request from many ranges of ips, tens of thousands or more request per second.
Is there a way to defend this kind of attack?
Is there a way to trace back to the ...
0
votes
2answers
184 views
iptables logs but doesn't drop packets
I am trying to create some simple iptables DOS protection rules for my web server. I was doing testing on the following rules:
iptables -N LOGDROP > /dev/null 2> /dev/null
iptables -F LOGDROP
...
1
vote
1answer
79 views
Can't figure out this attack, getting botnets and something else
About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out.
My site is not ...
2
votes
2answers
414 views
Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log
I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
3
votes
2answers
120 views
In what way am I more likely to be DDoS'd? Via http or other ports?
I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena.
The service will consist of:
a ...
3
votes
3answers
4k views
DOS attack “slow post” : How to prevent in IIS
I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability.
Have tried reducing the httpruntime ...
1
vote
3answers
168 views
Apache relaying to prevent DoS
I've been wondering, is there a technology that relays (slows down) responses to a given IP according to the rate It makes requests?
E.g I have an apache server with a "heavy" API service that I want ...
1
vote
1answer
72 views
What is idea of web server attack on thinker/js/think.js?
My web server is getting a lot of GET request on thinker/js/think.js and thinker/showSimilarInfo.do.
These requests obviously constitute a server attacks.
What is point of these attacks?
Also, ...
5
votes
1answer
775 views
Why are NginX and Lighttpd not affected by Slowloris?
I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works.
What I don't understand is why Lighttpd and NginX are not affected (according to the ...
5
votes
5answers
765 views
Ec2 Denial of Service: Securing cloud based website from DOS attack
How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy
0
votes
1answer
415 views
Windows Server 2008 Denial of Service Detection
We have a Windows 2008 server that hosts a file share in which a SQL server database is stored and accessed from another SQL server on the same network. Periodically, the database become inaccessible ...
2
votes
1answer
799 views
Protecting against UDP flood
One of my servers is being flooded with udp packets on random ports.
12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1
12:11:54.190447 IP 182.48.38.227.60173 > ...
2
votes
2answers
493 views
DDoS Attacks on Game Servers
We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
6
votes
3answers
354 views
Somebody eating all our bandwidth, what should I do?
OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
0
votes
1answer
407 views
Detecting DOS attack
On one of our systems we see many requests that take 75 seconds. Under low traffic responses are ca 0.3 seconds.
What I am wondering is if someone is trying to keep connections open in order to ...
1
vote
3answers
400 views
Fail2ban advice on banning IP's and HTTP
I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then ...
1
vote
2answers
498 views
Protecting against Keep-Dead Denial of service
i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash.
I've looked through the logs but can't see ...
1
vote
1answer
878 views
Logging Timeout'd Request in Apache 2.X
I am migrating some applications from Apache 1.3 to 2.2.
We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 ...
0
votes
2answers
174 views
CentOS Server keeps grinding to a halt, then comes back up
CentOS 5.2 LAMP server
The server slows down to a point where no services are responding. After a few minutes, it comes back and is running well. The server keeps doing this cycle, what could be ...
0
votes
1answer
231 views
DDOS Mitigation Services
Over the past week we have been a victim of two seperate ddos attacks varying in scale. The last one was very large and very hard to mitigate. We are looking at solutions from veriSign and Akamai ...
0
votes
2answers
562 views
what should be limit to use for IPTABLE rate limiting for a webserver
I see on my webserver some logs as follows
203.252.157.98 - :25:02 "GET //phpmyadmin/ HTTP/1.1" 404 393 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
203.252.157.98 - :25:03 "GET ...
0
votes
1answer
898 views
How do I prevent against a DOS attack through Outlook Web Access?
If I configure an Active Directory Lockout Policy, then someone can use repeated bad login attempts to lock users out.
How do I block an IP if enough bad login attempts come from it?
Can I do this ...
2
votes
3answers
459 views
DDOS by several IPs with one connection
I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
0
votes
3answers
357 views
Measure bandwidth by client IP in realtime
I have been recently attacked using DoS attack on random ports.
I wasn't able to get the attackers IP and now I would like to find it.
What tool can show me bandwidth (in Kbits/Mbits) used by each ...
