Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2183

Re: Slowing/delaying connections when there are already many connections from that source IP

Show all headers | View raw

In article <nbspt.41942$Lw2.3399@fe09.iad>,
Andrew Gideon  <c182driver9@gideon.org> wrote:
>I'm trying to find a good solution for the case where a single IP 
>attempts to open a large number of concurrent connections to a web 
>server.  I'm less concerned about the rate of connections, at least at 
>the moment; it is actual concurrent connections which have my attention.
>
>This comes from the case where I've seen "bad actors" use all connections 
>up to Apache's MaxClients.
>
>I know of a couple of different approaches, but neither makes me 
>completely happy.  With iptables and connlimit, excess connections can be 
>failed (either quietly DROPped or REJECTed with an ICMP error or TCP 
>reset).  With mod_security, sufficient connections (at least in the WRITE 
>state) can cause return of some "error page" to the browser.
>
>I'm wondering if there's another approach, where the SYN ACK (and so on) 
>can simply be delayed until the number of connections drops below some 
>threshold.  I looked around and haven't seen an iptables module that does 
>this (or which delays accepting or forwarding the SYN, which would 
>achieve that effect even more efficiently).

Delaying the SYN/ACK will probably not be a very good way to do this, as
the SYN will be resent after some timeout anyways. Possibly it will be
better to just drop the first (or first few) SYNs of a connection you want
to be slowed. This can be done with the statistic extension of iptables,
AFAICS.

cu

AW
-- 
[...] If you don't want to be restricted, don't agree to it. If you are
coerced, comply as much as you must to protect yourself, just don't support
it. Noone can free you but yourself. (crag, on Debian Planet)
Arne Wichmann (aw@linux.de)

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-29 18:56 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Rick Jones <rick.jones2@hp.com> - 2013-05-29 22:38 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:04 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP aw@anhrefn.saar.de - 2013-05-30 00:21 +0200
  Re: Slowing/delaying connections when there are already many connections from that source IP Jorgen Grahn <grahn+nntp@snipabacken.se> - 2013-05-30 06:45 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:19 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Jeff Long <long@ku.edu> - 2013-05-30 10:09 -0500
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-06-04 16:34 +0000

csiph-web