Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2180

Slowing/delaying connections when there are already many connections from that source IP

Show all headers | View raw

I'm trying to find a good solution for the case where a single IP 
attempts to open a large number of concurrent connections to a web 
server.  I'm less concerned about the rate of connections, at least at 
the moment; it is actual concurrent connections which have my attention.

This comes from the case where I've seen "bad actors" use all connections 
up to Apache's MaxClients.

I know of a couple of different approaches, but neither makes me 
completely happy.  With iptables and connlimit, excess connections can be 
failed (either quietly DROPped or REJECTed with an ICMP error or TCP 
reset).  With mod_security, sufficient connections (at least in the WRITE 
state) can cause return of some "error page" to the browser.

I'm wondering if there's another approach, where the SYN ACK (and so on) 
can simply be delayed until the number of connections drops below some 
threshold.  I looked around and haven't seen an iptables module that does 
this (or which delays accepting or forwarding the SYN, which would 
achieve that effect even more efficiently).

Any pointers or thoughts.  The goal is to let the activity ultimately 
succeed, but more slowly than otherwise.

Thanks...
	
	Andrew

Back to comp.os.linux.networking | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-29 18:56 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Rick Jones <rick.jones2@hp.com> - 2013-05-29 22:38 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:04 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP aw@anhrefn.saar.de - 2013-05-30 00:21 +0200
  Re: Slowing/delaying connections when there are already many connections from that source IP Jorgen Grahn <grahn+nntp@snipabacken.se> - 2013-05-30 06:45 +0000
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-05-30 13:19 +0000
  Re: Slowing/delaying connections when there are already many connections from that source IP Jeff Long <long@ku.edu> - 2013-05-30 10:09 -0500
    Re: Slowing/delaying connections when there are already many connections from that source IP Andrew Gideon <c182driver9@gideon.org> - 2013-06-04 16:34 +0000

csiph-web