Might need a nice mod_security rule for this one hit? Or you have a distributed DoS attack (on conjunction with phishing and pharming [do you take credit cards or get a boatload of hits?]) See: http://isc.sans.org/diary.html?storyid=6601&rss In considering the ramifcations of a slow denial of service attack against particular services, rather than flooding networks, a concept emerged that would allow a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports. The ideal situation for many denial of service attacks is where all other services remain intact but the webserver itself is completely inaccessible. Slowloris was born from this concept, and is therefore relatively very stealthy compared to most flooding tools. Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they'll allow. Slowloris must wait for all the sockets to become available before it's successful at consuming them, so if it's a high traffic website, it may take a while for the site to free up it's sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they'll still be able to see the site. So it's a bit of a race condition, but one that Slowloris will eventually always win - and sooner than later. On 6/18/09, Stephen wrote: > I have some Dermal Adhesive at home if you need me to bring it :-) > > On Wed, Jun 17, 2009 at 6:48 PM, wrote: >> Today's new lesson:  mod_evasive >> >> Set up on the new server, not the old one.  Now can someone help me >> glue my hair back on? >> >> >> -----Original Message----- >> From: Alex Dean >> To: Main PLUG discussion list >> Sent: Tue, Jun 16, 2009 7:06 pm >> Subject: Re: Apache Throttling Itself? >> >> >> >> >> >> >> >> >> >> >> On Jun 16, 2009, at 8:35 PM, Alex Dean wrote: >> >> >>> You have some badly-optimized query which is slowing the whole > >> process down. >> >> >> This should read "You *could* have some badly-optimized query...". >> Sorry. >> >> >> alex >> >> >> >> >> >> >> >> >> >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >> >> >> >> >> >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss > > > > -- > A mouse trap, placed on top of your alarm clock, will prevent you from > rolling over and going back to sleep after you hit the snooze button. > > Stephen > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > To subscribe, unsubscribe, or to change your mail settings: > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss > -- (503)754-4452 http://en.wikipedia.org/wiki/User:LisaKachold http://www.theregister.co.uk/2009/05/29/wikipedia_bans_scientology/ --------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us To subscribe, unsubscribe, or to change your mail settings: http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss