3

I have an Apache 2 server running PHP5, prefork MPM, eaccelerator and modevasive.

My server sometimes goes down, apparently due to flooding from some IPs. At least this is what I understand from running netstat. I get things like this :

tcp        0      0 my.ip.is.here:80        88.160.126.117:55864    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:57073    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:56989    ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57813    ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57695    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:57274    ESTABLISHED
tcp      602      0 my.ip.is.here:80        80.214.0.41:51131       ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:57513    ESTABLISHED
tcp        0      0 my.ip.is.here:80        77.88.31.248:64551      ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:55131    ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57565    ESTABLISHED
tcp      357      0 my.ip.is.here:80        209.85.228.92:51134     ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57817    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:53902    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:57060    ESTABLISHED
tcp      718      0 my.ip.is.here:80        82.252.2.103:49506      ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57553    ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57692    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:55571    ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57762    ESTABLISHED
tcp      639      0 my.ip.is.here:80        88.160.126.117:57771    ESTABLISHED
tcp     1750      0 my.ip.is.here:80        41.105.112.207:19940    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:57187    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:56782    ESTABLISHED
tcp      668      0 my.ip.is.here:80        86.72.212.166:64263     ESTABLISHED
tcp      750      0 my.ip.is.here:80        88.160.126.117:57681    ESTABLISHED
tcp        0      0 my.ip.is.here:80        88.160.126.117:56741    ESTABLISHED

so it looks like 88.160.126.117 is flooding my server. (It's a different IP everytime, so I can't manually block it) Mod_evasive does log this IP in its log, but does not stop this problem at all!

Even when I restart apache2, networking, the server gets stuck again reaching its maxclients setting.

Any idea what I may do?

My modevasive configuration is:

DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 20
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
4
  • Did you count the number of simultaneous requests from the same IP and compared them with the configured values? You may need to tune the mod_evasive parameters.
    – Khaled
    Nov 11, 2011 at 14:16
  • I've turned on apache logging now so I'll be able to check that next time my server hangs. I was also wondering if the problem shown by netstat (IP apparing multiple times with different ports) can be due to something else than flooding? Like a malfunctioning script on my end?
    – Eric
    Nov 11, 2011 at 14:28
  • OK, just had a new flood. Apache logs recorded up to 21 identical page requests per second from this IP. Isn't that weird? I thought mod_evasive wouldn't let that happen...
    – Eric
    Nov 11, 2011 at 15:05
  • I'm no mod_evasive expert, but the author's statement at zdziarski.com/blog/?page_id=442 suggests that by default it thresholds at 50 requests/address/sec.
    – MadHatter
    Nov 21, 2011 at 16:08

1 Answer 1

1

Low Limits

Your limits may be too low. Your limit is 20/second. If they attacker is hitting below this limit then the block will not trigger.

If the resource they are accessing is process intensive (e.g. search function), a very low request rate can take down the system.

You may have to fine tune the blocks based on the attack patterns.

There is a test.pl script included in mod_evasive, try it and see if you can trigger a block.

Target URL

Also what is the IP accessing? Try turning on server-status in Apache and check the URL. This will let you know if they are hitting the same page or different pages. This will let you know if PageCount of SiteCount is more appropriate.

Check the IP in your logs and see what rate at which they are connecting. Use this to find tune the limits. Note the limits are per-child. There is no guarantee that they will hit the same child-process.

Rapid Floods

Lastly, I have seen floods where the attacker makes dozens of connections at once. In this case, dos evasive may not have time to respond. It will block future requests, but if 100 have already been made it is too late. In these cases, use mod_dosevasive's feature to call iptables and do a full drop at the firewall.

MaxRequestPerChild

What is your Apache's MaxRequestPerChild setting? The rate limiting is on a per-child basis. I have seen cases where MaxRequestPerChild is too low to allow the mod_evasive to work. Typically not a problem but one area to check.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .