Detect Slowloris – How to Detect Slowloris Attacks

apache-2.2logging

I'm pretty sure I was under Slowloris attack. I set up an iptables rule to limit max connections to my webserver, but I'd like to know how I can figure out if it really was a Slowloris attack, and if so, how I can find the IP address of the attacker. I'd really like to pass the logs on to his ISP.

Thanks

Best Answer

Slowloris attacks work by sending request data as slow as possible. Therefore, if you could measure the bandwidth use per ip address then if it's below some threshold, (found by measuring the bandwidth in a known slowloris attack) then you know you are under attack.

To prevent attacks, I'd suggest switching your webserver software. I use cherokee which is resistant in it's default configuration. I can't ascertain whether nginx is vulnerable, but lighttpd is. I also can't be sure that using a resistant webserver as a proxy will make any difference.

Here's more information: http://ha.ckers.org/blog/20090617/slowloris-http-dos/

Related Solutions

Linux – Log every IP connecting on a system with iptables

I would try this:

# IP address entry older than one day
iptables -A ... -m recent --name mydaily ! --rcheck ! --seconds 86400 -j logandset
# IP address never seen before
iptables -A ... -m recent --name mydaily ! --rcheck -j logandset

# Custom chain for logging and refreshing
iptables -N logandset
iptables -A logandset -j LOG
iptables -A logandset -m recent --name mydaily --set

So your list mydaily will keep track of the last seen IP addresses, and if it was never seen before, or if the last seen is older than one day, the packet will be logged, and the list entry for that IP address be updated.

You should probably set ip_list_tot to a higher value for mydaily, as explained in the iptables manpage (In your case for /proc/net/xt_recent/mydaily).

Ssh – Can you block an ip with multiple connections? (Apache ddos attack)

There are hardware / firewalls that can do this. Your option at the apache level is a feature called "throttling". There used to be a module for this, but it seems it's been removed.

https://stackoverflow.com/questions/7467183/throttling-requests-by-ip-address-on-apache

Best Answer

Related Solutions

Linux – Log every IP connecting on a system with iptables

Ssh – Can you block an ip with multiple connections? (Apache ddos attack)

Related Topic