My web server is being attacked, Flood http?

Discussion in 'Security' started by Jawn, Jun 21, 2008.

  1. #1
    Heya guys,
    So im having abit of a problem, someone bringing down my apache all the time by flooding apache?

    This is how the logs look like from apache logs


    
    CPU Usage: u287.03 s11.86 cu0 cs0 - 46.3% CPU load 
    107 requests/sec - 0.6 MB/second - 5.9 kB/request 
    600 requests currently being processed, 0 idle workers 
    
    341-0 22401 0/3/480 W  0.03 451 0 0.0 0.03 2.71  172.205.92.241 domain.com GET / HTTP/1.1 
    342-0 22402 0/6/437 W  0.04 471 0 0.0 0.04 2.97  172.205.92.241 domain.com GET / HTTP/1.1 
    343-0 20251 0/215/299 W  2.02 491 0 0.0 1.63 2.17  172.205.92.241 domain.com GET / HTTP/1.1 
    344-0 21706 0/184/889 W  1.87 448 0 0.0 1.42 5.32  172.205.92.241 domain.com GET / HTTP/1.1 
    345-0 - 0/0/844 .  0.68 95 0 0.0 0.00 4.75  127.0.0.1 home.domain.com OPTIONS * HTTP/1.0 
    346-0 21084 0/186/949 W  1.86 450 0 0.0 1.56 6.60  172.205.92.241 domain.com GET / HTTP/1.1 
    347-0 22404 0/0/1122 W  1.83 488 0 0.0 0.00 5.95  172.205.92.241 domain.com GET / HTTP/1.1 
    348-0 21708 0/193/1225 W  1.93 459 0 0.0 1.23 7.51  172.205.92.241 domain.com GET / HTTP/1.1 
    349-0 22405 0/8/454 W  0.09 453 0 0.0 0.03 1.85  172.205.92.241 domain.com GET / HTTP/1.1 
    350-0 22406 0/20/579 W  0.21 451 0 0.0 0.05 3.82  172.205.92.241 domain.com GET / HTTP/1.1 
    351-0 22407 0/4/910 W  0.03 471 0 0.0 0.09 5.91  172.205.92.241 domain.com GET / HTTP/1.1 
    352-0 22410 0/0/943 W  4.42 488 0 0.0 0.00 6.02  172.205.92.241 domain.com GET / HTTP/1.1 
    Code (markup):

    What does this mean?
     
    Jawn, Jun 21, 2008 IP
  2. alcoholhost

    alcoholhost Peon

    Messages:
    12
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    #netstat -ntu | grep SYN_RECV | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

    if ip SYN_RECV > 20

    #iptables -A INPUT -s ip -j DROP

    #netstat -ntu | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

    if ip ESTABLISHED > 40

    #iptables -A INPUT -s ip -j DROP

    or tell isp to block it

    credit deflate.medialayer.com and ems
     
    alcoholhost, Jun 22, 2008 IP
  3. zacharooni

    zacharooni Well-Known Member

    Messages:
    346
    Likes Received:
    20
    Best Answers:
    4
    Trophy Points:
    120
    #3
    Looks like you need to just do this as root:

    /sbin/route add 172.205.92.241 reject
     
    zacharooni, Jun 24, 2008 IP