Denial of service attack, is an attempt through some means to make a computer or network resource unavailable.
25
votes
6answers
13k views
How to best defend against a “slowloris” DOS attack against an Apache web server?
Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against ...
18
votes
3answers
18k views
How do I block specific IPs and IP ranges in IIS7?
I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
11
votes
3answers
726 views
Any reason not to enable DoS Defense in my router?
I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
8
votes
8answers
414 views
Servers harrassed by individual on constantly changing IPs
We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
5answers
1k views
What are the best techniques for preventing denial of service attacks?
Currently I have been using (D)DoS-Deflate to manage such situations on numerous remote servers, along with Apache JMeter for load testing.
Overall it has been working fairly well, although I'd like ...
8
votes
4answers
993 views
Stopping a DOS attack
One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
6
votes
3answers
354 views
Somebody eating all our bandwidth, what should I do?
OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
6
votes
4answers
735 views
Is account lockout a denial of service attack waiting to happen?
The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three)..
This means that with the following
net use \\targetmachine\c$ ...
6
votes
2answers
260 views
Detecting server abuse
Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. ...
5
votes
1answer
770 views
Why are NginX and Lighttpd not affected by Slowloris?
I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works.
What I don't understand is why Lighttpd and NginX are not affected (according to the ...
5
votes
5answers
763 views
Ec2 Denial of Service: Securing cloud based website from DOS attack
How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy
5
votes
3answers
503 views
Is SYN flooding still a threat?
Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
4
votes
2answers
171 views
Tomcat Denial of Service due to large packets
I had asked this question on ITSecurity, but I felt this question is better placed here.
On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on ...
3
votes
2answers
120 views
In what way am I more likely to be DDoS'd? Via http or other ports?
I am writing a web service that has a lot of vicious competitors. Vicious as in: people have been getting DDoS'd within hours of setting up shop in this arena.
The service will consist of:
a ...
3
votes
3answers
1k views
Strange DNS DOS attack — Endless Recursive Queries for <blank domain>
Our W2K3 DNS servers seem to be under some kind of DOS attack, but I can't seem to find any description of, or rationale for the attack.
Three specific remote hosts have been bombarding two of our ...
3
votes
3answers
163 views
What criteria do you use to determine if someone is hammering your server?
When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you ...
3
votes
2answers
278 views
Is it possible to distinguish from “good” http requests and DoS attacks?
How could I know that a lot of requests in a short period of time come from a DoS attack and not from normal browser requests?
3
votes
2answers
464 views
iptables rate-limit module problem
I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks).
In my rules I have something like:
...
3
votes
3answers
4k views
DOS attack “slow post” : How to prevent in IIS
I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability.
Have tried reducing the httpruntime ...
3
votes
1answer
706 views
SYN flooding still a threat to servers?
Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
2
votes
2answers
492 views
DDoS Attacks on Game Servers
We run a fairly large game server hosting company with about 60 machines running Server 2008, and DDoS attacks something we have been dealing with for a long time. Unfortunately, due to the prices of ...
2
votes
6answers
552 views
Securing against DDoS
My client would like to have his eCommerce (custom-made) site secured from DDoS attacks. What strategies can I implement? There are multiple forms in the purchasing flow --- searching, drilling-down ...
2
votes
4answers
518 views
Tomcat denial of service
The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a ...
2
votes
3answers
380 views
How to stop repetitive hits from same host to same URL?
I have an odd problem-- on a high traffic website (millions of visitors a month), every day we get about 20 or so situations where one host begins incessantly requesting the same page, over and over-- ...
2
votes
5answers
551 views
2
votes
3answers
459 views
DDOS by several IPs with one connection
I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the ...
2
votes
2answers
822 views
Apache SSL Renogotiation (thc-ssl-dos)
Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled.
I have been checking a few servers and have the following questions;
First; renegotiations are disabled by ...
2
votes
3answers
3k views
Identifying DDOS Attacks on Windows 2008 Servers
I recently was notified by my monitoring service that a few Windows 2008 servers (hyper-v instances) were down.
I logged into the Hyper-V box and noticed everything was super slow. I opened task ...
2
votes
2answers
547 views
What does the arxiv.org anti-bot “search and destroy” actually do?
The lanl.arxiv.org math and scientific preprint service (formerly known as xxx.lanl.gov) has a strict policy against bots that ignore its robots.txt, Robots Beware. On that page, the have a link ...
2
votes
2answers
373 views
Prioritise ssh logins (nice)
Is there a preferred way to set "nice" for sshd?
I need priority given to sshd such that I can login and easily fix stuff when something has gone wrong (eg DoS, badly behaved processes, etc)
2
votes
2answers
110 views
Resolving a prolonged DDoS
I've been totally unable to use my server for the last couple of days. I've been contacting the owners of the IP's who are attacking me but its an uphill battle. Since I don't know who is doing the ...
2
votes
2answers
116 views
How do I locate a process on Debian Linux that is creating a large amount of network traffic? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned ...
2
votes
2answers
394 views
How do you stop PINGs from causing a DOS on a Linux server?
Have a CentOS-5.x box that appears to be going down as a result of PINGs. If the server gets PINGs it stops replying to ssh/http connections. Appears iptable is one approach, but I want to make sure ...
2
votes
4answers
938 views
Blocking IP addresses Load Balanced Cluster
We're using HAproxy as a front end load balancer / proxy and are looking for solutions to block random IP addresses from jamming the cluster.
Is anyone familiar with a conf for HAProxy that can block ...
2
votes
2answers
414 views
Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log
I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
2
votes
1answer
799 views
Protecting against UDP flood
One of my servers is being flooded with udp packets on random ports.
12:11:54.190442 IP 182.48.38.227.60173 > localhost.51523: UDP, length 1
12:11:54.190447 IP 182.48.38.227.60173 > ...
2
votes
1answer
242 views
Where can I find DoS attack simulator [closed]
I am taking a Security module and my project team intend to study DoS attacks by simulating them to better understand the mechanism, the damage and preventing mechanism, etc...
Could someone please ...
2
votes
0answers
115 views
Buffer-stuffing denial-of-service attack
I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what ...
1
vote
4answers
197 views
AD Domain Controllers being Slammed
My Windows Server 2008 Domain Controllers are getting hundreds of log in attempts per minute. For the most part the IP addresses are not in the Event Log however the ones that do occasionally show up ...
1
vote
3answers
400 views
Fail2ban advice on banning IP's and HTTP
I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then ...
1
vote
2answers
120 views
Has anyone experienced unintentional traffic overload due to clients' use of wget?
I am wondering if it is wise to indiscriminately block wget on servers that I maintain.
Has anyone experienced unintentional traffic overload due to clients' use of wget?
1
vote
2answers
776 views
Kernel Printk: xx message suppressed
Hi I have a watchguard firewall, and I lost access to the firewall before xmas, therefore I visited the site, upgraded the firewall to the latest firmware but unfortunatly, I am now having similar ...
1
vote
2answers
406 views
Ping size limit - FreeBSD
In the man page for FreeBSD ping:
-s packetsize
Specify the number of data bytes to be sent. The default is 56,
which translates into 64 ICMP data bytes when combined with the 8
...
1
vote
3answers
149 views
What is the best way to prevent somone abusing access to your site using scripts?
What is the best way to prevent someone abusing access to your site using scripts?
1
vote
3answers
420 views
ESXi server under DoS attack, can I use SSH to determine where from?
My VMWare ESXi 4 server appears to be under a Denial of Service attack. I am getting massive packet loss to the server (60+%) and am barely able to load any services on the VMs running on the host.
I ...
1
vote
4answers
1k views
Brainstorm: Flood/DoS/DDoS Attack prevention ideas
This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks.
...
1
vote
2answers
362 views
Finding Evidence of a Denial of Service Attack (Linux)
We had a Gentoo Linux server (that was updated weekly or bi weekly) that higher ups claimed did a denial of service attack on the whole local network and brought it down.
Are there any log files we ...
1
vote
4answers
186 views
rhel-5.3->vm wordpress attack
i have a rhel 5.3 w/ few virtual machines and one of virtual pc runs
cpu: intel quad 2.83
mem: 3.5G
os: Linux 2.6.18-128.1.14.el5xen #1 SMP Mon Jun 1 16:09:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
...
1
vote
2answers
3k views
(D)DOS - tcpdump established connections analysis (too many established connections)
¿How can I debug this problem?
(I've got full tcpdump captures)
I have a TCP server into which many clients establish persistent connections. Normally all these clients behave, and I never reach ...
1
vote
2answers
496 views
Protecting against Keep-Dead Denial of service
i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash.
I've looked through the logs but can't see ...
