Apache DOS attack

[David Nixon]

I have over the past few months experienced what seems to be a DOS attack on our Web server. I can now characterise these attacks -
if that's what they are.

Running Apache A.2.0.55.00 HP-UX 11.11
with the standard server configuration:

StartServers 2
MaxClients 50
etc..

Symptoms:

The two Apache server processes
consume 99% of CPU between them.

The servers make excessive use of the poll() and sendfile() system calls; to serve requests for certain files in the 2-5GB size range.

Further connections to port 80 fail, though other network connections (rlogin,ssh) remain operational.

Stopping Apache leaves a large number of connections in state CLOSE_WAIT (see attached "connhist" output).

To clear these connections and allow Apache
to start you may have to shutdown and restart
from S.U. mode.

The current source of these problems are a small range of IP addresses, owned by the same ISP, but other addresses have been involved.

The only report of a similar DOS attack I found was in a Windows bug report. Unsurprisingly no solution was offered.

Is anyone experiencing similar?

Apart from blocking offending client connections what measures can be taken to help Apache cope in this situation?


Thanks for your interest,
Dave.

[spex · Accepted solution]

Hi David,

The following links should give you a starting point for countering DoS attacks against Apache.

"Protect your Apache server from DoS attacks"
http://articles.techrepublic.com.com/5100-6329-5058830.html

"Apache DoS Evasive Maneuvers Module"
http://www.securityfocus.com/tools/2923

"Blocking Apache Attacks"
http://www.perlcode.org/tutorials/apache/attacks.html

PCS

[David Nixon]

Some useful references.
Thanks,
Dave.