DOS Attack Over Apache, Full Of READING Connections

Feb 5, 2007

As you can see my apache is full of Reading connections..... they are filling up my server dening legitimate users to browse trought the websites hosted there... I think this is what is happening to me:
http://mail-archives.apache.org/mod_...l.gmail.com%3E

Im using apache 1.3.3.7 on RHES 3 with latest patches and kernel.

930 requests currently being processed, 6 idle servers
RRRRRRRRWRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRR
RRRRRRRRRWRRRWRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR_RRRRRRRRRRRRR_RRRRRRR
RRRRRRRRRRRRRRRRRRRRRRWRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
R_WRRRRRRRRRRRRRRRRRRRRWWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRR
RRRRRRRRRRRRRWRR_RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR_
RRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRR_RRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRWRRRRR
RRRRRRRRRRWRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR.......................

1-044940/40/40R 0.33340.00.060.06 ??..reading..
2-044950/55/55R 0.47330.00.110.11 ??..reading..
3-044960/35/35R 0.31330.00.050.05 ??..reading..
4-044970/38/38R 0.13210.00.090.09 ??..reading..
5-045410/40/40R 0.16360.00.130.13 ??..reading..
6-046190/28/28R 0.12110.00.030.03 ??..reading..
7-046220/34/34R 0.35320.00.100.10 ??..reading..
8-051640/34/34R 0.135100.00.300.30 ??..reading..

Also, here is the top output of the top command:

top - 12:46:21 up 10 min, 1 user, load average: 1.40, 2.03, 1.06
Tasks: 1063 total, 2 running, 1060 sleeping, 0 stopped, 1 zombie
Cpu(s): 4.9% us, 1.6% sy, 0.0% ni, 93.1% id, 0.3% wa, 0.0% hi, 0.0% si
Mem: 2073516k total, 2001984k used, 71532k free, 42384k buffers
Swap: 2048276k total, 0k used, 2048276k free, 178096k cached

Server seems to be fine, but total tasks are always between 1060 and 1124... thats very rare too..

how to avoid this attack?

View 14 Replies


ADVERTISEMENT

Apache Hangs When Having Lots Of ..reading.. Requests

Jan 26, 2008

A weird thing happents once on few days on my server, and it's not a regular thing or on exact time.

When I have this problem no page can be loaded in the browser, but WHM is working, i think because it's accessed by IP .

In apache status page I can see lots of ..reading.. requests which are there even for 10 - 20 seconds sometimes.

Usualy the server has 10 - 20 requests/s :

CPU Usage: u35146 s2297.05 cu2.74 cs4.5 - 6.97% CPU load
11.2 requests/sec - 83.0 kB/second - 7.4 kB/request
10 requests currently being processed, 8 idle servers

But when the ..reading.. requests appear it goes much higher like 100 to 200

11.5 requests/sec - 85.3 kB/second - 7.5 kB/request
200 requests currently being processed, 0 idle servers

after 3 minutes :

160 requests currently being processed, 30 idle servers

When I logged on to SSH I saw that there are ~150 conection from a single IP .

View 14 Replies View Related

Linux Apache Folder Not Reading Without Trailing Slash

Jan 4, 2007

I am running apache 2.0 on CentOS 4.4 with PHP5 and mysql 5. I am wondering why the following is happening with apache:

if I goto to [url]

This does not work, it times out. But if I goto:

[url]

With the trailing slash it works. That is annoying, anyway to take care of that so it works with or without the trailing slash? Below is my httpd.conf folder and virtual host settings:

---------------------------------------------------------------------------------------------------------------

<VirtualHost *>
ServerAdmin myemail@mydomain.com

DirectoryIndex index.php index.html index.htm index.shtml

<Directory "/var/www/html/">
Options ExecCGI FollowSymLinks Includes IncludesNOEXEC SymLinksIfOwnerMatch

AllowOverride none
</Directory>
</VirtualHost>

#
# Each directory to which Apache has access can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#

<Directory "/">
Options FollowSymLinks

AllowOverride None
</Directory>

<Directory "/var/www/html">
Options Indexes Includes FollowSymLinks

AllowOverride None
Allow from all

Order allow,deny
</Directory>

<Directory "/var/www/icons">
Options Indexes MultiViews

AllowOverride None
Allow from all

Order allow,deny
</Directory>

<Directory "/var/www/cgi-bin">
Options ExecCGI

AllowOverride None
Allow from all

Order allow,deny
</Directory>

View 13 Replies View Related

Apache :: Error Reading Status Line From Remote Server

Aug 6, 2014

We are currently using Apache 2.2.10 as the reverse proxy for the SAP portal server 7.3.1. The SAP applications are built based on webdynpro abap technology.2 of the apps are getting intermittent spinning circles. The Apache server will ultimately timeout and give the "bad request" and HTTP 400. We were never able to reproduce the problem except we do see users are running into them. Obviously, the problems occur very randomly, but often enough to generate a lot of support tickets. No error was generated in the sap system log.

Here is what I see from the apache access log and error log:

[31/Jul/2014:23:50:26 -0400] TLSv1 AES128-SHA "POST /sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=VcFRQjFOvu8TJYp9gDoeAA--4x1GQAg0MPPjCUEQif5iWQ--?sap-contextid=SID%3aANON%3asapprd_PR3_03%3aezUnW-FXtaYVyXREaAD7rxW0k8o5pk_n9RfjPfcB-NEW HTTP/1.1" 400 3004 "https://xxxxx/sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=VcFRQjFOvu8TJYp9gDoeAA--4x1GQAg0MPPjCUEQif5iWQ--" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" 706345611

[Fri Aug 01 14:19:07 2014] [error] [client 10.4.53.198] (70014)End of file found: proxy: error reading status line from remote server xxxxxx, referer: https://xxxxx/sap/bc/webdynpro/sap/ZR_SSEPP_OPERATIONAL_SCHEDULE;sap-ext-sid=RaH2yjQlV6o7wVaj6wv6zA--LXTMFzjjKvcuwT*DXWoBmA--

I found bug 37770 and went to see the apache admin. But he thinks that the parameter(proxy-initial-not-pooled=1) that fixes the bug only applies to mod_proxy_http. However, we are using mod_proxy.

View 1 Replies View Related

Apache :: Reverse Proxy Modules - Error Reading Status Line From Remote Server

Oct 17, 2013

We have been using Apache 2.2.x with reverse proxy modules for our clients to access their OWA servers for over a year. I want to get us to Apache 2.4.x so I setup a test box with latest 2.4 on it. I fixed the config file issues since 2.4 has changes in it. OWA proxy is working on my test server with Apache 2.4. But with 2.4 I do have an issue I cannot figure out. Note that this does NOT occur with Apache 2.2. I get the following errors when using ActiveSync through reverse proxy:

[Thu Oct 17 12:19:11.670665 2013] [proxy_http:error] [pid 748:tid 8440] (OS 10060)A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. : [client x.x.x.x:20311] AH01102: error reading status line from remote server mail.nameredacted.net:443
[Thu Oct 17 12:19:11.670665 2013] [proxy:error] [pid 748:tid 8440] [client x.x.x.x:20311] AH00898: Error reading from remote server returned by /Microsoft-Server-ActiveSync

So somehow with Apache 2.4 there is some sort of timeout that was not there with 2.2.

View 2 Replies View Related

How Many Connections Apache Can Go Up To

Sep 15, 2008

Just logged in my cPanel, and Apache Server Status shows

Parent Server Generation: 7
Server uptime: 2 hours 52 minutes 5 seconds
Total accesses: 701666 - Total Traffic: 63.7 GB
CPU Usage: u1610.22 s255.4 cu0 cs0 - 18.1% CPU load
68 requests/sec - 6.3 MB/second - 95.2 kB/request
400 requests currently being processed, 0 idle workers

I told customer service and said my website (a big forum) have 4000 people now, I felt very slow, could the slowness caused by this max apache connection setting?

I got reply: "400 seems to be as high as Apache can go. Your httpd.conf settings currently show 500 max connections enabled. If Apache is stopping at 400 then this is it's hard limit for maximum connections. Also If it was able to go even higher you would eventually run into memory issues on the server that would cause the server to crash."

Can anyone tells me if "400 requests currently being processed, 0 idle workers " is a problem or could it be the cause of the slowness. I imagin if more people request connection, and apache can't deal with that much, it has to let those request wait in the queue, therefore caused slowness or time-out.

The seem server could deal with 8000 people online before, no any problem at all and speed was quite fast. I don't know what i should do now.

View 14 Replies View Related

Max Apache Connections

Jan 19, 2007

is a way to understand whats the bext max apache settings for me?

Maybe to look over httpd-status requests currently being processed and the number of idle servers or the number of strokes?

Or probably the best way is to use some benchmark application but then i am not sure how to test my config?

View 4 Replies View Related

Too Many Apache Connections

Sep 24, 2007

I currently have a dedicated server with the following specs:

Celeron 2.6ghz
2gb ram
100mbit connection

the cpu load is always under 0.7, and I always have at least 400mb of free ram.

The site takes about 5-10 seconds to load a test page with just a single word on it. When I type netstat -n | grep :80 | wc -l
I get around 1100-1200 connections. I get about 130k page views per day.

My site is about 95% static html, it has about 150 images per page. How can I speed up my site?

Here are my apache httpd.conf settings:
Timeout - 100
KeepAlive - on
KeepAliveTimeout - 12
StartServers - 48
MinSpareServers - 32
MaxSpareServers - 64
MaxClients - 1500
MaxRequestsPerChild - 1000000

View 6 Replies View Related

Monitoring Apache Connections

Feb 22, 2008

whats the easiest way to monitor the number of apache connections?

View 9 Replies View Related

Apache Request Is Full

Dec 6, 2008

when i check apache status, i see one domain send many request to server, for example:
domain.com 10.20.30.40
domain.com 10.20.30.40
domain.com 10.20.30.40
domain.com 10.20.30.40
domain.com 10.20.30.40
-
-
-
how can i prevent this problem?
this problem tease me and my server, because induce apache to work unremitting.
Ram Usage is: 65%!

View 5 Replies View Related

Apache Not Showing Full URL?

Apr 1, 2013

When I go to the [URL] ... is loads the index page just fine. When I go use the [URL] .... it still loads the index page, I don't want it to do that, I want it it to load test.php. When I click on a link (for say [URL] ....) on index.php the url stays as [URL] ....; I actually want it to show [URL] .... (while I test things at least). Is this a .htaccess issue?

View 2 Replies View Related

Weird Single IP Uses Up All Apache Connections

Jul 11, 2009

Our web server encounter a problem lately, that an IP address in India repetitively sent requests that uses up all connections available in Apache. All connections appear to be in W state. The connections are not terminated by Apache even though timeout has been set to lower 30 seconds. Similarly, MySQL connections also are not dropped until Apache is restarted.

View 7 Replies View Related

Maximum Number Of Apache Connections

Feb 24, 2007

I would like to know what is the maximum number of Apache connections a Server can handle? Does this depends on the Config of the Server? Is it Possible for a server to handle more than 2500 Active Apache connections without timeout / connection failure / slowness?

View 6 Replies View Related

Apache Won't Terminate Connections, We're About To Give Up!

Apr 19, 2007

I've got an older "Super Server P4" series server @ ThePlanet - it's been a great box for years. We recently upgraded php4 to php5 and did a mysql upgrade as well. Ever since, randomly, without warning, Apache stops terminating connections, so the max connections fills up, and httpd won't respond. Apache doesn't stop running, it just max's out and stops accepting new connections, so customers assume the server is "down", although email/FTP work fine.

The server never crashes, the loads stay down, but httpd just fills up and won't accept more connections. We can't increase max connections (we actually DECRESED IT), because they'll just keep piling up, never terminating, and then ultimately, it will crash the box.

My admin has worked for nearly 2 weeks trying to figure it out, and Scott (AtomicRocketTurtle) and his team have been evaluating it for about a week - it's happened 3x in 2 days ... last night, httpd quit responding for about 7+ hours and since we didn't have httpd monitoring, we never knew until the office opened this AM and I had two very angry customers. Scott suspects it may be some rogue application that triggers it that didn't affect it prior to the php5/mysql upgrades.

Both Scott and Parm, my admin, have about thrown in the towel and are recommending we retire the server and migrate to a new box.

It's older - much older .. I'm pasting specs below, RHEL3, Plesk 7.5 .. but just wonder, before retiring an old server that was RUNNING GREAT prior to the upgrade, maybe someone has seen this happen before?

If so - PLEASE LET US KNOW before I spend the $$$ on a new box.

Current box's specs:

CPU GenuineIntel, Intel(R) Pentium(R) 4 CPU 2.80GHz
Version psa v7.5.4_build75060118.18 os_RedHat el3
OS Linux 2.4.21-47.0.1.ELsmp
RAM: 1GB, with 2GB swap
apache 1.3.31
bind 9.2.4-20.EL3
coldfusion Component was not installed
coldfusion-support 7.3-2.96.128
courier-imap 3.0.8-rhel3.build75050824.12
drweb 4.32.2-rh7_psa
drweb-qmail 4.32-rhel3.build75050824.12
frontpage 5.0.2.2634
httpd 2.0.46-61.ent
jdk 1.4.2
logrotate 3.7
mailman 2.1.5.1-25.rhel3.7
mod_perl 1.99_09-10.ent
mod_python 3.0.3-5.ent
mysql 4.1.21-2.rhel3.art
perl-Apache-ASP 2.57-rhel3.build75050824.12
php 5.0.4-13.rhel3.art
phpmyadmin 2.5.3
phppgadmin 2.4.2
postgresql 7.3.6-7
postgresql-server 7.3.18-1
proftpd 1.2.9
psa 7.5.4-rhel3.build75050824.12
psa-agent 1.3.2-2_psa7.1
psa-api-rpc 7.5.4-rhel3.build75050930.11
psa-bu 7.5.4-rhel3.build75050926.17
psa-horde 3.0.5-rhel3.build75050824.12
psa-imp 4.0.3-rhel3.build75050824.12
psa-logrotate 3.7-rhel3.build75050824.12
psa-manual-custom-skin-guide 7.5.4-rhel3.build75050824.12
psa-migration-manager 7.5.4-rhel3.build75050930.11
psa-proftpd 1.2.10-rhel3.build75050824.12
psa-qmail 1.03-rhel3.build75050824.12
psa-qmail-rblsmtpd 0.70-rhel3.build75050824.12
psa-spamassassin Component was not installed
psa-tomcat-configurator 7.5.4-rhel3.build75050824.12
psa-turba 2.0.3-rhel3.build75050926.17
qmail 1.03
rblsmtpd 0.70
samba 3.0.9-1.3E.12
spamassassin 3.1.3-1
SSHTerm 0.2.2-rhel3.build75050824.12
stunnel 4.04-4
tomcat 4.1.24-full.2jpp
webalizer 2.01_10-15.ent

View 4 Replies View Related

How To Set Max Number Of Connections In Apache (on Windows 7)

Apr 11, 2013

I am trying to figure out how Apache is working on windows 7 - so far so good - but how do I set restrictions and limitations on bandwidth usage and max number of IP-connections?

View 1 Replies View Related

Apache :: TCP Connections Getting Restarted (2.4.6-x86 Server)

Oct 29, 2013

Webserver is restarted all TCP connections randomly. we are not able to get any error into errorlog file.

Webserver close all TCP connection and start created new TCP connection for new request.

AcceptFilter http none
AcceptFilter https none

Also, conf file is saying that
Defaults Values are:
EnableMMAP On
EnableSendfile Off

Not sure what's wrong with server.

We have installed "Apache 2.4.6-x86 server" on Win 2008 R2 Standard server (64-Bit).

Also, we are using mod_jk module for connecting to tomcat server "tomcat-connectors-1.2.37-windows-i386-httpd-2.4.x.zip".

View 4 Replies View Related

Apache Attack

Sep 30, 2007

I've a dedicated with 1 site hosted on, but its a big forum that have a numerous apache attack like :

entersomenicedatastringshereidontthinkthisislongenoughsoiwilladdmorehehe

190218806268

[Thu Sep 27 08:59:12 2007] [error] [client 41.221.18.199] Invalid URI in request entersomenicedatastringshereidontthinkthisislongenoughsoiwilladdmorehehe

707671880723

[Thu Sep 27 08:59:12 2007] [error] [client 60.54.153.233] mod_security: Access denied with code 403. Pattern match "!HTTP\/(0\.9|1\.0|1\.1)$" at THE_REQUEST [id "340000"][rev "1"] [msg "Bad HTTP Protocol"] [severity "1"] [uri ""]
mod_security: Access denied with code 403. Pattern match "!HTTP\/(0\.9|1\.0|1\.1)$" at THE_REQUEST [id "340000"][rev "1"] [msg "Bad HTTP Protocol"] [severity "1"] [uri ""]
[Thu Sep 27 08:59:49 2007] [error] [client 80.78.48.132] File does not exist: /usr/local/apache/htdocs/403.shtml
[Thu Sep 27 08:59:49 2007] [error] [client 87.110.121.99] Invalid URI in request entersomenicedatastringshereidontthinkthisislongenoughsoiwilladdmorehehe

607938289643

[Thu Sep 27 08:59:50 2007] [error] [client 220.116.89.243] Invalid URI in request entersomenicedatastringshereidontthinkthisislongenoughsoiwilladdmorehehe

309682726861

---

Mod_security, mod_evasive are installed of course but they cant block this from happening which stops the apache from working.

I've even asked LT to install Cicso ASA 5505 as they told me it will help much, but seems like they don't know how to manage it, so that the server went down every few min for 24 hour till I asked them to uninstall it.

Does the Cicso firewall really helps in that case or what ? if so, what provider should I move to that have experienced staff and can get it work in right way?

View 14 Replies View Related

Check Which Account Apache Max Out The Number Of Connections

Nov 13, 2008

I am facing to this trouble: apache max out the number of connections. When viewing status, all I get here

Code:

SrvPIDAccMCPU SSReqConnChildSlotClientVHostRequest
0-028240/6/65R 0.1414290.00.020.32 ??..reading..
1-028170/17/65R 0.111510.00.030.22 ??..reading..
2-028350/3/57R 0.20112210.00.000.24 ??..reading..
3-027570/33/62R 1.431412930.00.130.21 ??..reading..
4-026430/75/75R 2.12153190.00.310.31 ??..reading..
5-026440/52/52R 2.061610.00.240.24 ??..reading..
6-028180/13/60R 0.621600.00.070.22 ??..reading..
7-026490/63/63R 2.84143070.00.370.37 ??..reading..
8-028190/7/43R 0.271610.00.020.27 ??..reading..
9-028080/27/76R 0.361410.00.040.29 ??..reading..
10-026750/50/52R 2.9617630.00.260.26 ??..reading..
11-027720/23/49R 3.641600.00.100.19 ??..reading..
12-026620/64/64R 2.201520.00.290.29 ??..reading..
13-027730/25/64R 1.121500.00.140.19 ??..reading..

which account on server is the reason please? I am on CentOS box with DirectAdmin.

View 2 Replies View Related

Rule To Limit Apache (port 80) Connections From 1 IP To 15

Apr 12, 2007

any good rule to limit Apache (port 80) connections from 1 IP to 15 with iptables/csf?

And total connections to the box to 100?

View 6 Replies View Related

Limit Apache (thread) Connections Per Request

Jan 9, 2007

I've been having trouble the past few days with someone who's been "attacking" my site so to speak by continuously downloading very large files with as many connections as (he) can open. I operate a large downloads site for computer games, this person has selected the largest files (like 400-500MB). Not sure of the real intent other than to clog up my bandwidth capacity. Also he appears to be using proxies since as soon as I ban one, another shows up seeminly from China.

Anyway, I have mod_bw and I've limited the number of connections in the downloads area to 2. While that works ok, his tool uses threads like a download manager would and he's using up 30-40 child threads for his 2 file downloads.

So 2 questions,

Is there anyway to not only limit file downloads to 2, but limit the number of connections per request? Many of my visitors do use download managers and I'd like for them to continue using them but use a reasonable number of threads like 6 or 8, but not 30.

Also, is there a way to restrict access to someone using a proxy?

View 2 Replies View Related

Get The Number Of Current Connections In Apache Server?

Apr 7, 2014

I am interested to know number of current connections in my Apache server
Server version: Apache/2.2.15 (UNIX)
OS : Solaris 5.10

View 5 Replies View Related

Apache DoS Global Attack

Jun 20, 2009

I have just saw on leaseweb noc site that there has been a public release of a Apache DoS tool and all All versions of Apache are vulnerable.

So can anyone confirm this and give some possible solution or advices? ....

View 14 Replies View Related

Move Full Apache/php Install To Another Server

Jan 14, 2007

Is there a way to tar a compiled apache/php installation and move it to another identical server?

If on the first server I specify all the configure options for both apache and php to point to /usr/local/apache2 for example, and then tar apache2 dir and untar it on another server will everything work just like it should? Or do I need to compile apache/php from scratch on the second server.

It would be nice to just be able push the apache/php tar file on to the new provisioned server and be ready to go.

Has anyone done this before, what is the best way to do this and are there any issues to look for.

View 3 Replies View Related

Apache Not Showing Full File Size

Aug 15, 2007

I have a 2,3 and 5GB files that I need to download but everytime they appear as 1.4GB for some reason. I've tried IE, Mozilla and opera and the same result each time.

Is there some sort of limit to the size of a file that apache will serve?

View 4 Replies View Related

How Do I Secure Apache From Ddos Attack's

May 17, 2009

way to secure apache from ddos attack's on centos 5.3.

View 7 Replies View Related

Modifying Apache Status To Include Full SubDomain URL

May 19, 2008

if its possible to display subdomains on the Apachelog page? For example under "vhost" it would list the full website address of each subdomain?

View 2 Replies View Related

Apache :: Type Full Address With Port Number?

Jan 30, 2014

Have to type the full address with port number....

View 4 Replies View Related

DDOS Attack Kill Only Apache Server

Jan 11, 2007

I have a question related DDOS attack. My hosting provider told me that my Server was DDos attacked few days ago. But in those days my server worked fine only apache server was down. The strange fact is that in the same day with this "DDOS attack" one of theyr admins worked something on SSL section of my server and during this operation the SSL hosts were down and httpd worked slow.

Inthe passed 3 months httpd worked very slow and after 2-3 restarts of httpd service the load droped down below 3.00 . I believe theyr httpd service was already with problems and that SSL configuration cause that apache failure in that day with "ddos attack"

I repeat in that day ONLY ssl hosts worked fine and non SSL hosts were down.

It's possibile on DDOS attack that load to be unde 0.5 , SSL hosts to work fine, FTP, Mail and other stuf to work like there is nobody on server (VERY FAST)?

View 1 Replies View Related

Apache Under Attack :: Configured Request Variable Value Length Limit Exceeded

Apr 21, 2008

My server was unstable at this month sometimes fork 700 process and apache 80 access per second and that's made server very slow . very bad browsing

when i checked log files /var/log/messages found that errors

Apr 20 04:06:28 suhosin[798]: ALERT - configured request variable value length limit exceeded - dropped variable 'message' (attacker '212.107.116.238', file '/usr/local/cpanel/cgi-sys/php4')
Apr 22 00:27:05 suhosin[15442]: ALERT - configured request variable name length limit exceeded - dropped ....

View 6 Replies View Related

Reading RTG

May 26, 2008

What does green and blue color mean? is my total amount of traffic the total of both colors?

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved