Article View: comp.security.misc
Article #1137Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non resolving...
From: Lachlan Cranswick
Date: Thu, 12 Nov 1998 00:00
Date: Thu, 12 Nov 1998 00:00
173 lines
11330 bytes
11330 bytes
(There was a previous security article about non-resolving IP addresses.
This may or may not be related?).
Are there tools or methods available for Web-serving/Apache/UNIX that
can help distinguishing between network misconfigs/slowness/nuances
vs attempted Denial of Services Attacks on the Web-server port?
I have some very wierd behaviour on the Apache 1.3.3 webserver
for SGI O2 running IRIX 6.3 - with DNS resolution enabled inside
the webserver.
An occassional occurance for me is to see the Apache 1.3.3
server-status screen gives "Client" names of ????
"Vhost" of ????? and "Request" of "reading... with very "bursty"
start/stop speeds. (1/2th to 1/20th of normal average throughput
from web-server to a local client PC when this is happening).
Nothing obvious in the default apache logs.
This occured today but was ready for it with tcpdump.
For this event:
The only thing in the TCPDUMP logs not easily explanable is a
lot of activity with an IP address of 151.104.78.243 that is
not pingable and dies on a tracetroute in the
"bbnplanet.net" domain. Activity from this IP ceases but
another replaces it for a few minutes: 151.99.133.130
which is also not pingable and dies on a traceroute
near "interbusiness.it" domain.
Is this enough information to explain things? Just
in case, examples of the TCPDUMP (v3.4a5) and the traceroute
are given below. Nothing seems to be showing up in
the UNIX SYSLOG and Deception Toolkit shows no probes
on other ports.
Lachlan.
PS: Brings up another query - is there a tool that could do a TCPDUMP
and also tell what files are being transferred as part of the status
line with respect to http?
TCPDUMP of 151.104.78.243 hitting the http port:
************************************************************
16:43:20.314048 sv1.http > 151.104.78.243.4873: FP 5841:6006(165) ack 160 win 61320 (DF)
16:43:20.690926 151.104.78.243.4873 > sv1.http: . ack 6007 win 8595 (DF)
16:43:20.824125 151.104.78.243.4873 > sv1.http: F 160:160(0) ack 6007 win 8595 (DF)
16:43:20.824248 sv1.http > 151.104.78.243.4873: . ack 161 win 61320 (DF)
16:43:21.723077 151.104.78.243.4880 > sv1.http: S 19853440:19853440(0) win 8192 <mss 1460> (DF)
16:43:21.723318 sv1.http > 151.104.78.243.4880: S 1192966000:1192966000(0) ack 19853441 win 61320 <mss 1460> (DF)
16:43:22.111992 151.104.78.243.4880 > sv1.http: . ack 1 win 8760 (DF)
16:43:22.352313 151.104.78.243.4880 > sv1.http: P 1:156(155) ack 1 win 8760 (DF)
16:43:22.370785 sv1.http > 151.104.78.243.4880: . 1:1461(1460) ack 156 win 61320 (DF)
16:43:22.370867 sv1.http > 151.104.78.243.4880: . 1461:2921(1460) ack 156 win 61320 (DF)
16:43:25.274577 sv1.http > 151.104.78.243.4880: . 1:1461(1460) ack 156 win 61320 (DF)
16:43:26.123811 151.104.78.243.4880 > sv1.http: . ack 2921 win 8760 (DF)
16:43:26.123988 sv1.http > 151.104.78.243.4880: . 2921:4381(1460) ack 156 win 61320 (DF)
16:43:26.124062 sv1.http > 151.104.78.243.4880: FP 4381:5794(1413) ack 156 win 61320 (DF)
16:43:26.619182 151.104.78.243.4880 > sv1.http: . ack 5795 win 8760 (DF)
16:43:26.672060 151.104.78.243.4880 > sv1.http: F 156:156(0) ack 5795 win 8760 (DF)
16:43:26.672177 sv1.http > 151.104.78.243.4880: . ack 157 win 61320 (DF)
16:43:26.845438 151.104.78.243.4883 > sv1.http: S 19858562:19858562(0) win 8192 <mss 1460> (DF)
16:43:26.845623 sv1.http > 151.104.78.243.4883: S 1193798000:1193798000(0) ack 19858563 win 61320 <mss 1460> (DF)
16:43:27.266242 151.104.78.243.4883 > sv1.http: . ack 1 win 8760 (DF)
16:43:27.275817 151.104.78.243.4883 > sv1.http: P 1:169(168) ack 1 win 8760 (DF)
16:43:27.278348 sv1.http > 151.104.78.243.4883: . 1:1461(1460) ack 169 win 61320 (DF)
16:43:27.278463 sv1.http > 151.104.78.243.4883: . 1461:2921(1460) ack 169 win 61320 (DF)
16:43:27.752481 151.104.78.243.4883 > sv1.http: . ack 2921 win 8760 (DF)
16:43:27.752633 sv1.http > 151.104.78.243.4883: FP 2921:3443(522) ack 169 win 61320 (DF)
16:43:28.185871 151.104.78.243.4883 > sv1.http: . ack 3444 win 8238 (DF)
16:43:28.465642 151.104.78.243.4883 > sv1.http: F 169:169(0) ack 3444 win 8238 (DF)
16:43:28.465757 sv1.http > 151.104.78.243.4883: . ack 170 win 61320 (DF)
16:43:34.189921 151.104.78.243.4892 > sv1.http: S 19865658:19865658(0) win 8192 <mss 1460> (DF)
16:43:34.190192 sv1.http > 151.104.78.243.4892: S 1194758000:1194758000(0) ack 19865659 win 61320 <mss 1460> (DF)
16:43:39.774545 sv1.http > 151.104.78.243.4892: S 1194758000:1194758000(0) ack 19865659 win 61320 <mss 1460> (DF)
16:43:43.636191 151.104.78.243.4892 > sv1.http: S 19865658:19865658(0) win 8192 <mss 1460> (DF)
16:43:43.636320 sv1.http > 151.104.78.243.4892: S 1194758000:1194758000(0) ack 19865659 win 61320 <mss 1460> (DF)
16:43:44.766979 151.104.78.243.4892 > sv1.http: . ack 1 win 8760 (DF)
TCPDUMP of 151.99.133.130 hitting the http port:
************************************************************
17:14:50.024543 151.99.133.130.57032 > sv1.http: S 141282566:141282566(0) win 8760 <mss 1460> (DF)
17:14:50.024989 sv1.http > 151.99.133.130.57032: S 1449414000:1449414000(0) ack 141282567 win 61320 <mss 1460> (DF)
17:14:53.178950 151.99.133.130.57032 > sv1.http: P 1:460(459) ack 1 win 8760 (DF)
17:14:53.187859 sv1.http > 151.99.133.130.57032: P 1:472(471) ack 460 win 61320 (DF)
17:14:53.215387 sv1.http > 151.99.133.130.57032: F 472:472(0) ack 460 win 61320 (DF)
17:14:53.561938 151.99.133.130.57032 > sv1.http: . ack 473 win 8760 (DF)
17:14:53.561998 151.99.133.130.57032 > sv1.http: F 460:460(0) ack 473 win 8760 (DF)
17:14:53.562292 sv1.http > 151.99.133.130.57032: . ack 461 win 61320 (DF)
17:14:54.151463 151.99.133.130.57096 > sv1.http: S 155778963:155778963(0) win 8760 <mss 1460> (DF)
17:14:54.151889 sv1.http > 151.99.133.130.57096: S 1449990000:1449990000(0) ack 155778964 win 61320 <mss 1460> (DF)
17:14:56.381969 151.99.133.130.57032 > sv1.http: F 460:460(0) ack 473 win 8760 (DF)
17:14:56.382146 sv1.http > 151.99.133.130.57032: . ack 461 win 61320 (DF)
17:14:59.774857 sv1.http > 151.99.133.130.57096: S 1449990000:1449990000(0) ack 155778964 win 61320 <mss 1460> (DF)
17:15:00.093672 151.99.133.130.57096 > sv1.http: . ack 1 win 8760 (DF)
17:15:00.110463 151.99.133.130.57096 > sv1.http: P 1:459(458) ack 1 win 8760 (DF)
17:15:00.185868 sv1.http > 151.99.133.130.57096: . 1:1461(1460) ack 459 win 61320 (DF)
17:15:00.185964 sv1.http > 151.99.133.130.57096: . 1461:2921(1460) ack 459 win 61320 (DF)
17:15:00.491748 151.99.133.130.57096 > sv1.http: . ack 1461 win 8760 (DF)
17:15:00.492089 sv1.http > 151.99.133.130.57096: . 2921:4381(1460) ack 459 win 61320 (DF)
17:15:00.492197 sv1.http > 151.99.133.130.57096: . 4381:5841(1460) ack 459 win 61320 (DF)
17:15:00.573683 151.99.133.130.57096 > sv1.http: . ack 2921 win 8760 (DF)
17:15:00.573900 sv1.http > 151.99.133.130.57096: . 5841:7301(1460) ack 459 win 61320 (DF)
17:15:00.853675 151.99.133.130.57096 > sv1.http: . ack 5841 win 8760 (DF)
17:15:00.854035 sv1.http > 151.99.133.130.57096: . 7301:8761(1460) ack 459 win 61320 (DF)
ATTEMPTED TRACEROUTE of 151.104.78.243
**************************************
/usr/etc/traceroute 151.104.78.243
traceroute to 151.104.78.243 (151.104.78.243), 30 hops max, 40 byte packets
1 alan3.dl.ac.uk (148.79.1.1) 2 ms (ttl=32!) 1 ms (ttl=32!) 1 ms (ttl=32!)
2 nnw-gw.dl.ac.uk (193.63.74.1) 2 ms (ttl=29!) 2 ms (ttl=29!) 2 ms (ttl=29!)
3 gw-mcc.netnw.net.uk (194.66.24.1) 5 ms (ttl=28!) 5 ms (ttl=28!) 5 ms (ttl=28!)
4 manchester-core.ja.net (146.97.253.133) 6 ms 10 ms 6 ms
5 external-gw.ja.net (146.97.253.57) 16 ms 16 ms 15 ms
6 tglobe-gw2.ja.net (193.63.94.80) 17 ms 17 ms 18 ms
7 ppt-gw.ja.net (193.62.157.10) 95 ms 97 ms 103 ms
8 gin-ppt-bb2.Teleglobe.net (207.45.215.165) 99 ms (ttl=247!) 96 ms 100 ms
9 gin-ppt-bb1.Teleglobe.net (207.45.215.2) 97 ms 107 ms 99 ms
10 gin-nyy-core1.Teleglobe.net (207.45.199.233) 116 ms 128 ms 124 ms
11 gin-nyy-bb1.Teleglobe.net (207.45.223.170) 113 ms 112 ms 113 ms
12 h3-0-0.nyc4-br1.bbnplanet.net (4.0.3.21) 120 ms 111 ms 115 ms
13 p3-0.nyc4-nbr3.bbnplanet.net (4.0.3.145) 118 ms 116 ms 115 ms
14 p1-3.cambridge1-nbr2.bbnplanet.net (4.0.2.169) 129 ms 127 ms *
15 p1-0-0.cambridge1-br2.bbnplanet.net (4.0.1.46) 120 ms 117 ms 123 ms
16 f0.cambridge1-mr5.bbnplanet.net (206.34.78.38) 127 ms 122 ms 125 ms
17 s4-5.worcester-cr1.bbnplanet.net (206.34.110.10) 128 ms
s3-2.worcester-cr1.bbnplanet.net (206.34.110.14) 137 ms
s2-5.worcester-cr1.bbnplanet.net (206.34.110.22) 171 ms
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
/usr/etc/traceroute 151.99.133.130
traceroute to 151.99.133.130 (151.99.133.130), 30 hops max, 40 byte packets
1 alan3.dl.ac.uk (148.79.1.1) 1 ms (ttl=32!) 1 ms (ttl=32!) 1 ms (ttl=32!)
2 nnw-gw.dl.ac.uk (193.63.74.1) 3 ms (ttl=29!) 2 ms (ttl=29!) 2 ms (ttl=29!)
3 gw-mcc.netnw.net.uk (194.66.24.1) 5 ms (ttl=28!) 4 ms (ttl=28!) 6 ms (ttl=28!)
4 manchester-core.ja.net (146.97.253.133) 8 ms 7 ms 9 ms
5 external-gw.ja.net (146.97.253.57) 17 ms 17 ms 15 ms
6 ten34-gw.ja.net (193.63.94.250) 18 ms 22 ms 17 ms
7 janet.UK.ten-34.net (193.203.228.9) 22 ms 19 ms 22 ms
8 london6.att-unisource.net (195.206.64.69) 18 ms 17 ms 18 ms
9 london5.att-unisource.net (195.206.64.49) 24 ms 22 ms 23 ms
10 amsterdam9.att-unisource.net (195.206.65.29) 30 ms 30 ms 36 ms
11 geneva5.att-unisource.net (195.206.65.242) 60 ms 44 ms 49 ms
12 195.206.66.182 (195.206.66.182) 172 ms 169 ms (ttl=245!) 194 ms (ttl=245!)
13 195.22.192.14 (195.22.192.14) 237 ms (ttl=245!) 173 ms (ttl=244!) *
14 r-rm9-seabone-6.interbusiness.it (151.99.49.181) 589 ms (ttl=244!) 364 ms (ttl=244!) 284 ms (ttl=244!)
15 r-rm5-fe3.interbusiness.it (151.99.5.209) 291 ms (ttl=243!) 274 ms (ttl=243!) 310 ms (ttl=243!)
16 r-rm4-fe1.interbusiness.it (151.99.5.147) 239 ms (ttl=242!) 432 ms (ttl=242!) 464 ms (ttl=242!)
17 151.99.8.70 (151.99.8.70) 365 ms (ttl=242!) 371 ms (ttl=242!) 416 ms (ttl=242!)
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
Lachlan M. D. Cranswick
Collaborative Computational Project No 14 (CCP14)
for Single Crystal and Powder Diffraction
Daresbury Laboratory, Warrington, WA4 4AD U.K
Tel: +44 (0)1925-603703 Fax: +44 (0)1925-603124 Room C14
E-mail: l.cranswick@dl.ac.uk
CCP14 Webpage (Under heavy construction):
http://www.ccp14.ac.uk
Technical Details
Message-ID:
<l.cranswick.209.01C47D5D@dl.ac.uk>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10952f,56bc51684084cbe5,start X-Google-Attributes: gid10952f,public X-Google-Thread: ff723,56bc51684084cbe5,start X-Google-Attributes: gidff723,public X-Google-Thread: f8b34,56bc51684084cbe5,start X-Google-Attributes: gidf8b34,public X-Google-Thread: 1133d0,56bc51684084cbe5,start X-Google-Attributes: gid1133d0,public From: l.cranswick@dl.ac.uk (Lachlan Cranswick) Subject: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non resolving IP Addresses) Date: 1998/11/12 Message-ID: <l.cranswick.209.01C47D5D@dl.ac.uk> X-Deja-AN: 410906990 Organization: Daresbury Laboratory Newsgroups: comp.security.misc,cern.security.unix,comp.security.unix,comp.infosystems.www.servers.unix