3

I currently have a custom implementation in PHP/mysql that keeps track of web hits and blocks those that exceed a certain rate for the same IP. I.e. if a given source IP hits the server more than X times in the last Y seconds then it will be served a redirect to a predefined location Z and the normal request processing will be aborted.

It works OK, but puts significant stress on MySQL.

So I was wondering if there is a special tool for this available? Maybe an Apache module or some kind of filter?

2 Answers 2

7

The best

  • mod_evasive (Focused more on reducing DoS exposure)
  • mod_cband (Best featured for 'normal' bandwidth control)

and the rest

One more option - mod_qos

Not simple to configure - but powerful.

http://opensource.adnovum.ch/mod_qos/

2
  • Thanks. mod_evasive seems to only serve 403 responses for blocked addresses, but mod_cband looks promising!
    – rustyx
    Sep 23, 2013 at 12:16
  • 4
    Note that this answer is a verbatim copy of stackoverflow.com/questions/131681/…. Don't plagiarize other peoples answers without attribution.
    – Sven
    May 1, 2018 at 14:31
5

you may be able to do this at a lower level with iptables and bypass apache/mysql all together.... match and forward to another host / port? i have only dropped:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 6 -j DROP
2
  • So anyone can DOS you by filling that little "6 conns per minute" bucket?
    – Michuelnik
    Nov 24, 2014 at 17:02
  • This bucket is per IP, no?
    – rustyx
    Apr 21, 2015 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.