Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2187

Re: Slowing/delaying connections when there are already many connections from that source IP

Show all headers | View raw

On 05/29/2013 01:56 PM, Andrew Gideon wrote:
> I'm trying to find a good solution for the case where a single IP
> attempts to open a large number of concurrent connections to a web
> server.  I'm less concerned about the rate of connections, at least at
> the moment; it is actual concurrent connections which have my attention.
>
> This comes from the case where I've seen "bad actors" use all connections
> up to Apache's MaxClients.
>
> I know of a couple of different approaches, but neither makes me
> completely happy.  With iptables and connlimit, excess connections can be
> failed (either quietly DROPped or REJECTed with an ICMP error or TCP
> reset).  With mod_security, sufficient connections (at least in the WRITE
> state) can cause return of some "error page" to the browser.
>
> I'm wondering if there's another approach, where the SYN ACK (and so on)
> can simply be delayed until the number of connections drops below some
> threshold.  I looked around and haven't seen an iptables module that does
> this (or which delays accepting or forwarding the SYN, which would
> achieve that effect even more efficiently).
>

Not sure it matches your requirements but have you looked at 
mod_limitipconn?

Jeff Long

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-29 18:56 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Rick Jones <rick.jones2@hp.com> - 2013-05-29 22:38 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:04 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP aw@anhrefn.saar.de - 2013-05-30 00:21 +0200
  Re: Slowing/delaying connections when there are already many connections from that source IP Jorgen Grahn <grahn+nntp@snipabacken.se> - 2013-05-30 06:45 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:19 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Jeff Long <long@ku.edu> - 2013-05-30 10:09 -0500
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-06-04 16:34 +0000

csiph-web