possible ddos?

tony404 · 09-03-2008

My server went down for about 10 mins today. Talked to support the guy said it could of been ddos or password trading. If it happens again they will be able to say without question they are watching the server. It seems 4000 requests to the members area came thru one ip. That crashed the server. Here are the questions would a ddos come thru one ip and only for 10mins? Secondly how many requests at once should the avg server be able to take without crashing?

helix · 09-03-2008

Sounds more like a password hurler to me because you said one IP. I don't know how many requests a server is supposed to handle until it pukes but I would think a good admin could set it to redirect or deny if you get too many requests in a preset amount of time. You might want to ask them.

gonzo · 09-04-2008

Quote:

Originally Posted by tony404

My server went down for about 10 mins today. Talked to support the guy said it could of been ddos or password trading. If it happens again they will be able to say without question they are watching the server. It seems 4000 requests to the members area came thru one ip. That crashed the server. Here are the questions would a ddos come thru one ip and only for 10mins? Secondly how many requests at once should the avg server be able to take without crashing?

NatNet,Mojohost or Caronet monitoring would have proactively caught this.

Hell Puppy · 09-04-2008

This should be a non-issue for most any adult host these days. Sounds like a brute force password attack. I'm surprised you dont see that several times a day if you're not blocking it.

And it certainly shouldn't cripple the server even if you let 'em thru.

Off the top of my head, I would only expect that to happen if you were doing something like running perl scripts on the entrance to the members area. Perl is interpreted and can be easily swamped when pounded with volume.

A good SA should be able to look at your logs and see exactly what happened during that time period.

09-03-2008	#1
tony404 Members Join Date: Nov 2003 Posts: 926	possible ddos? My server went down for about 10 mins today. Talked to support the guy said it could of been ddos or password trading. If it happens again they will be able to say without question they are watching the server. It seems 4000 requests to the members area came thru one ip. That crashed the server. Here are the questions would a ddos come thru one ip and only for 10mins? Secondly how many requests at once should the avg server be able to take without crashing? __________________ www.creamycandy.com yum yum.

09-03-2008	#2
helix Jebus loves me Join Date: Dec 2004 Location: 40 Oz to Freedom Posts: 857	Re: possible ddos? Sounds more like a password hurler to me because you said one IP. I don't know how many requests a server is supposed to handle until it pukes but I would think a good admin could set it to redirect or deny if you get too many requests in a preset amount of time. You might want to ask them. __________________ Sigless

09-04-2008	#4
Hell Puppy Fat Fucking Nobody Want to see your own Advertising Here! Join Date: Oct 2002 Posts: 6,523	Re: possible ddos? This should be a non-issue for most any adult host these days. Sounds like a brute force password attack. I'm surprised you dont see that several times a day if you're not blocking it. And it certainly shouldn't cripple the server even if you let 'em thru. Off the top of my head, I would only expect that to happen if you were doing something like running perl scripts on the entrance to the members area. Perl is interpreted and can be easily swamped when pounded with volume. A good SA should be able to look at your logs and see exactly what happened during that time period.