🚀 go-pugleaf

In <l.cranswick.209.01C47D5D@dl.ac.uk> l.cranswick@dl.ac.uk (Lachlan Cranswick) writes:



>(There was a previous security article about non-resolving IP addresses.
>This may or may not be related?).

>Are there tools or methods available for Web-serving/Apache/UNIX that 
>can help distinguishing between network misconfigs/slowness/nuances 
>vs attempted Denial of Services Attacks on the Web-server port?

>I have some very wierd behaviour on the Apache 1.3.3 webserver
>for SGI O2 running IRIX 6.3 - with DNS resolution enabled inside
>the webserver.

>An occassional occurance for me is to see the Apache 1.3.3 
>server-status screen gives "Client" names of ????    
>"Vhost" of ????? and "Request" of "reading...  with very "bursty" 
>start/stop speeds.  (1/2th to 1/20th of normal average throughput
>from web-server to a local client PC when this is happening).  
>Nothing obvious in the default apache logs.

How many of them?  What percent of total connections were the "????"
ones? What is happening in that case is a client is connecting and
not making a request, but still tying up a child process.  A type of
DoS attack is possible by simply opening more and more connections 
until there are no more child processes.

A netstat -n | grep ESTABLISHED  should show the current connections,
look for one remote IP with a lot of them.

Symptoms of this include a lot of the ???? entries in the scoreboard,
plus very long times until a response is started, but once a response
is started it should be at around normal speed.

Future versions of Apache should have a directive to let you tune
the maximum number of connections that any single remote IP can have
open at a single time.

Note that this could also be caused by a broken client.  A random
NT box tried to make 10000 simultaneous connections to one of our
web sites a while ago.  The admin says he couldn't see anything odd
on the box.

[...]

>TCPDUMP of 151.104.78.243 hitting the http port:
>************************************************************
>16:43:20.314048 sv1.http > 151.104.78.243.4873: FP 5841:6006(165) ack 160 win 61320 (DF)

Don't see anything too unusual there offhand.