Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2186

Re: Slowing/delaying connections when there are already many connections from that source IP

Show all headers | View raw

On Thu, 30 May 2013 06:45:11 +0000, Jorgen Grahn wrote:

> I'm not saying you shouldn't do this. But keep in mind that "a single
> IP" doesn't equate a single user.

I do know this, but thanks for reminder.

No, I'm not sure.  That's why I'm using mod_security to try to put up a 
warning page at a threshold lower than the "syn drop" (as it is now) in 
iptables.  The idea is that people will notify us if they see the warning 
page, and this tells us we need to tweak our values.

Unfortunately, mod_security doesn't seem to have an exact match to 
iptable's connlimit (at least as far as I can tell).  It can limit the 
number of connections in the READ or WRITE states, but not the union of 
these (nor does it count those threads in a Keepalive wait).

Hmm.  I could, I suppose, use connlimit to trigger a DNAT to send the 
request to a different - lighter weight - web server which displayed a 
warning page.  That may be overkill for what I'm trying to accomplish, 
but I think I'll mull that over.

Perhaps I should look again for an Apache module that more directly 
corresponds to the behavior of iptable's connlimit.

However, I confess that I do believe the problem is at least most often a 
case of "bad actors".  In one case, for example, an Internet search 
yielded claims that the IP was a source of comment spam.

	- Andrew

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-29 18:56 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Rick Jones <rick.jones2@hp.com> - 2013-05-29 22:38 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:04 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP aw@anhrefn.saar.de - 2013-05-30 00:21 +0200
  Re: Slowing/delaying connections when there are already many connections from that source IP Jorgen Grahn <grahn+nntp@snipabacken.se> - 2013-05-30 06:45 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:19 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Jeff Long <long@ku.edu> - 2013-05-30 10:09 -0500
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-06-04 16:34 +0000

csiph-web