PDA

View Full Version : possible ddos?

tony404
09-03-2008, 10:05 PM
My server went down for about 10 mins today. Talked to support the guy said it could of been ddos or password trading. If it happens again they will be able to say without question they are watching the server. It seems 4000 requests to the members area came thru one ip. That crashed the server. Here are the questions would a ddos come thru one ip and only for 10mins? Secondly how many requests at once should the avg server be able to take without crashing?
helix
09-03-2008, 11:02 PM
Sounds more like a password hurler (http://www.google.com/search?q=password+hurler&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a) to me because you said one IP. I don't know how many requests a server is supposed to handle until it pukes but I would think a good admin could set it to redirect or deny if you get too many requests in a preset amount of time. You might want to ask them.
gonzo
09-04-2008, 01:24 AM
My server went down for about 10 mins today. Talked to support the guy said it could of been ddos or password trading. If it happens again they will be able to say without question they are watching the server. It seems 4000 requests to the members area came thru one ip. That crashed the server. Here are the questions would a ddos come thru one ip and only for 10mins? Secondly how many requests at once should the avg server be able to take without crashing?
NatNet,Mojohost or Caronet monitoring would have proactively caught this.
Hell Puppy
09-04-2008, 02:13 AM
This should be a non-issue for most any adult host these days. Sounds like a brute force password attack. I'm surprised you dont see that several times a day if you're not blocking it.

And it certainly shouldn't cripple the server even if you let 'em thru.

Off the top of my head, I would only expect that to happen if you were doing something like running perl scripts on the entrance to the members area. Perl is interpreted and can be easily swamped when pounded with volume.

A good SA should be able to look at your logs and see exactly what happened during that time period.