Apache is flooded with hundreds of readings for vhost

abefroman · 02-15-2006, 09:11 AM

Apache is flooded with hundreds of readings for vhost

When I goto the apache server status page it shows hundreds of:
13-2 22464 0/177/5517 R 6.63 3 0 0.0 4.32 53.65 ? ? ..reading..

Appearently a script is half connecting to apache and then leaving the connection open and connecting again until Max Clients is hit

I have Timeout set to 5 and keep alive off. I also have mod dos evasive installed.

How can I get apache to drop the connections that are "reading"?

pk21 · 02-16-2006, 10:51 PM

check with netstat if the requests all come from the same ip. if so, then firewall it.

abefroman · 02-17-2006, 02:35 AM

They are from hundreds of different IPs

Darin · 02-17-2006, 12:37 PM

Quote:

Originally Posted by abefroman

They are from hundreds of different IPs

That would be called a DDoS (Distributed Denial of Service) attack. This board, and The Internet in general, are filled with info on how to tweak Apache (and Linux in general) to survive DDoS.

abefroman · 02-17-2006, 03:06 PM

Quote:

Originally Posted by Darin

That would be called a DDoS (Distributed Denial of Service) attack. This board, and The Internet in general, are filled with info on how to tweak Apache (and Linux in general) to survive DDoS.

I have made all those tweaks, how can I stop this one level above the server?

Darin · 02-17-2006, 04:18 PM

Quote:

Originally Posted by abefroman

I have made all those tweaks, how can I stop this one level above the server?

Buy a powerful firewall?
http://www.juniper.net/products/integrated/
http://www.cisco.com/en/US/products/...evc/index.html
http://www.extremenetworks.com/produ...es/Default.asp
http://www.google.com/search?hl=en&q=hardware+firewall

nx5000 · 02-20-2006, 04:05 AM

If the packets arrive on your network/webserver, even if you refuse all of them or rate-limit them with the most powerfull firewall on earth, they still arrive.. and if the attackers have a bigger bandwidth than you, it will overflow your bandwidth.

And in your case, its not even spoofing or icmp flooding, no, its just legitimate web traffic.

As said in another thread, only the ISP can do something about it.