How to stop apache DDOS Attack?

h2d

Verified User
Joined
Aug 11, 2006
Messages
103
Hi

I currently have an issue with one of my domains which is being attacked by some form of bot network.

Its attacking the webserver on port 80 trying to POST & GET to certain pages of the CMS that the website is running. Even tho comments are disabled and the bots are not able to post, its still causing extremely highly load on my server.

The connections are coming from multiple source addresses which are forever changing.
The website is currently getting about 100,000 to 150,000 hits a day.

How can i stop this!?

Thanks in advance :)
 
100k-150k hits a day is very low (~1.5 per second), you have to find a recurring pattern otherwise you risk blocking legitimate users.
As Dravu suggests, check how many connections are those bot making in the same time, this could be one of the patterns. You can use "netstat -tn |grep :80 |tr ':' ' ' |sort -k 6,4" to do that.
Also use "tshark" to find an IP pattern (TCP window, source port, anything).
 
Back
Top