1

I have a custom HTTP server.

When F5 is held down in a browser the server gets slammed with requests.

How can I detect and limit these (or any other) invalid connections?

It seems that I would have to record, for each incoming IP, the length of time between each request and whether or not the request was valid. If a certain number of invalid requests are received in a certain period time, I would simply disconnect (or ban) all further connections coming from that IP for a certain period of time.

Does anyone have any articles, pointers or tips on this subject?

Improve this question
1
  • You're coding your own http server? This might get a better response at stack overflow, especially if you provided details on programming language, goals of the server, etc. And some rationale on why you're not just using nginx :) nginx.org/en
    – JasonBirch
    Sep 11, 2010 at 7:01

2 Answers 2

Reset to default
1

Try some of the QoS settings now available for either:

  • the firewall(s)
  • the http server
  • the load balancers
  • any OS global settings

There are many types of (D)DoS attacks that may happen. The situation you have described is limited due to it only coming from one source, multiply that in a distributed attack and a per client limit can be avoided. Another attack could try and cause a memory overflow by filling the state information rapidly. More attacks exist, such as Slowloris so it makes sense to defend yourself holistically.

We like to use L7 firewalls on Linux (regex on packets) and weigh the clients by how often they honour Last-Modified & Etags, alongside other "good behaviour" (faster request times, larger MTUs, persistent connections, etc). You can always throw a Captcha, or artificially delay the response on a single connection with a backoff timer (1 second delay, 2 second delay, 4 second delay, etc). The trick here was to limit by connection (not the IP address, referrer, user agent or some combination thereof).

A future project will be to use the Intrusion Detection system to configure the rate limiting.

HTML 5's cache manifest will effectively disable server load during a F5 refresh and there is always Google Gears.

Improve this answer
1
  • Agree that the firewall is going to be your best option to limit this type of thing (although the captcha is a unique idea as well). However, if the page never loads past the header, then you may never see the captcha, so it would be rendered useless. But IPTables is probably going to be your friend in the end.
    – John P
    Sep 11, 2010 at 21:30
0

It appears that you have tried posting this to Stackoverflow:

https://stackoverflow.com/questions/3673188/http-server-invalid-request-connection-throttling

Posting this to Serverfault might get a couple responses, however, there are many threads already over there related to denial-of-service type attacks. You might try looking at those threads, just search for DDOS and DOS or denail-of-service.

Denial-of-service attacks are best handled by router hardware (like Cisco).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.