Main Content
Spotting a denial of service attack Archive - Originally posted on "The Horse's Mouth" - 2005-06-12 07:17:19 - Graham Ellis
Our web site traffic rose from 37000 hits last Wednesday to 64000 hits on Thursday. Good sales and marketing activity on our part? No - it's a potential problem; all the extra traffic came from a single location and my immediate concerns included:
* Possible denial of service, where all the bandwidth was being eaten up by the visitor.
* What use were they making of what was approaching a complete copy of the site?
* Potential extra costs if we were to hit our traffic ceiling
On this occasion, I noticed that we had a problem on Friday when I looked at the previous day's log analysis and spotted the problem sticking out like a sore thumb. I spent a couple of hours yesterday investigating more thoroughly, and putting a filter in place to cap aggressive browsing as it happens - a piece of PHP some 30 or 40 lines long. PHP's a powerful language, so in those lines I'm also able to add a permanent record of the potential abuse to a database ...
If you want to read more, I've put a technical analysis and sample PHP script in our solution centre.
Some other articles
W512 - Site Design Aspects Promoting a single one of your domains on the search engines How big is a web page these days? Does the size of your pages matter? Tags used in writing this blog Global Index to help you find resources Every link has two ends - fixing 404s at the recipient Mood shots UK legal requirements for your commercial web site Maintainable code - some positive advice Search engine placement - long term strategy and success Databases needn't be frightening, hard or expensive Put the answer in context - it may be printed An excellent use for a visitor count? Remember a site's non-technical issues too Protecting images from theft Denial of Service ''attack'' Colour doesn't have to mean colourful Dynamic Web presence - next generation web site One mans pleasure is another mans poison Improved mining techniques! This article Accommodation and landing pages Colour blindness for web developers Putting a form online A fortunate accident H117 - Security in PHP A small teaching program - demonstration of principles only Injection Attacks - PHP, SQL, HTML, Javascript - and how to neutralise them An easy way to comply with the new cookie law if your site is well designed How to stop forms on other sites submitting to your scripts Catchable fatal error in PHP ... How to catch, and alternative solutions such as JSON Protecting your images from use out of context Security considerations in programming - what do we teach? An example of an injection attack using Javascript Injection Attack if register_globals in on - PHP Injection Attacks - avoiding them in your PHP Who is watching you? Defensive coding techniques in PHP? PHP - Sanitised application principles for security and useability Are nasty programs looking for security holes on your server? A story about benchmarking PHP Using PHP to upload images / Store on MySQL database - security questions Error logging to file not browser in PHP Easy handling of errors in PHP Injection attacks - safeguard your PHP scripts Learning to write secure, maintainable PHP What is an SQL injection attack? A lion in a cage - PHP Robust checking of data entered by users This article H112 - Further Web Page and Network Handling Moving from mysql to mysqli - simple worked example Passing variable between PHP pages - hidden fields, cookies and sessions Multiple page web applications - maintaining state - PHP Telling which ServerAlias your visitor used - useful during merging domains Easy session example in PHP - keeping each customers data apart 3 digit HTTP status codes - what are they, which are most common, which should be a concern? Sending out an email containing HTML from within a PHP page Downloading a report from the web for further local analysis Uploading a document or image to its own URL via a browser How to build a test harness into your PHP Shipping a test harness with your class in PHP http, https and ajp - comparison and choice Downloading data for use in Excel (from PHP / MySQL) Keeping staff up to date on hotel room status Script to present commonly used images - PHP PHP / Web 2 logging Single login and single threaded models - Java and PHP Copyright and theft of images, bandwidth and members. Simple page password protection - PHP .php or .html extension? Morally Static Pages PHP header() function - uses and new restrictions Updating a page strictly every minute (PHP, Perl) Improving searches - from OR to AND? PHP Image upload script Passing GET parameters through Apache mod_rewrite Global, Superglobal, Session variables - scope and persistance in PHP Of course I'll tell you by email Image maps for navigation - a straightforward example Hot answers in PHP Finding the language preference of a web site visitor Adding PHP tags to an old cgi program PHP - setting sort order with an associative array Using PHP to output images, XML, Style sheets, etc Morning image, afternoon image Daily Image Santafied Setting the file name for a downloaded document Accessing a page via POST from within a PHP script Server side scripting of styles to suit the browser Caching an XML feed Reading a news or blog feed (RSS) in your PHP page What brings people to my web site? Time calculation in PHP Sudoku helper or sudoku cheat This article What language is this written in? When to use Frames A603 - Further httpd Configuration Identifying and clearing denial of service attacks on your Apache server Helping search engines with appropriate 400 error codes Building up from a small PHP setup to an enterprise one Forwarding a whole domain, except for a few directories - Apache http server Parse error: parse error, unexpected T_STRING on brand new web site - why? Apache Internal Dummy Connection - what is it and what should I do with it? An image from a website that occasionally comes out as hyroglyphics Redirecting a page - silent, temporary or permanent? How did I do THAT? Monitoring and loading tools for testing Apache Tomcat Database connection Pooling, SSL, and command line deployment - httpd and Tomcat Moving a directory on your web site How to avoid duplicating web page maintainance mod_rewrite for newcomers mod_proxy_ajp and mod_proxy_balancer examples Pointing all the web pages in a directory at a database mod_proxy and mod_proxy_ajp - httpd WEB-INF (Tomcat) and .htaccess (httpd) Configuring Apache httpd What to do if the Home Page is missing User and Group settings for Apache httpd web server Strange behaviour of web directory requests without a trailing slash Default file (MiMe types) for Apache httpd and Apache Tomcat Online hotel reservations - Melksham, Wiltshire (near Bath) Which modules are loaded in my Apache httpd Using a MySQL database to control mod_rewrite via PHP Load Balancing with Apache mod_jk (httpd/Tomcat) .php or .html extension? Morally Static Pages Compressing web pages sent out from server. Is it worth it? Simple but effective use of mod_rewrite (Apache httpd) Sharing the load with Apache httpd and perhaps Tomcat httpd.conf or .htaccess? Passing GET parameters through Apache mod_rewrite Clustering, load balancing, mod_rewrite and mod_proxy To list a directory under httpd on a web server, or not? Using different URLs to navigate around a single script An unhelpful error message from Apache httpd Denial of Service ''attack'' Apache httpd to Tomcat - jk v proxy 2006 - Making business a pleasure Apache httpd - serving web documents from different directories Separating 'per instance' data from binaries and web sites This article