Tag: DDoS

  • Apache Website not loading – DDoS

    Apache Website not loading – DDoS

    On a Fresh Cpanel Server, after pointing the domain name to the server, the website won’t load. Some times site loads after a very long wait. Apache was working fine and the server load was normal.

    Cpanel/WHM Apache status

    On checking Apache status in WHM, I found all workers are in use

    150 requests currently being processed, 0 idle workers

    On another somewhat busy production server, I had “18 requests currently being processed, 132 idle workers”.

    Current Time: Saturday, 22-Oct-2022 04:25:16 UTC
Restart Time: Wednesday, 28-Sep-2022 05:46:18 UTC
Parent Server Config. Generation: 119
Parent Server MPM Generation: 118
Server uptime: 23 days 22 hours 38 minutes 58 seconds
Server load: 0.98 1.32 1.56
Total accesses: 8832035 - Total Traffic: 511.0 GB - Total Duration: 12701232339
CPU Usage: u344.48 s101.28 cu71563 cs11674.9 - 4.05% CPU load
4.27 requests/sec - 259.0 kB/second - 60.7 kB/request - 1438.09 ms/request
18 requests currently being processed, 132 idle workers

    On checking apache error log /etc/apache2/logs/error_log, i have error related to MaxRequestWorkers

    AH00288: scoreboard is full, not at MaxRequestWorkers
AH00287: server is within MinSpareThreads of MaxRequestWorkers, consider raising the MaxRequestWorkers setting
AH00286: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting

    You can find the errors with the command

    grep MaxRequestWorkers /etc/apache2/logs/error_log

    On checking the connection with netstat, there were a lot of incoming connections

    netstat -tn 2>/dev/null | grep -E ':80|:443' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

    netstat ddos

    The server was getting some DDoS attacks causing the server to go down. The issue is fixed by enabling the DDoS protection service provided by the server provider.

    Back to DDoS

  • DDoS Protection Service

    DDoS Protection Service

    DDoS Protection

    https://sucuri.net/website-firewall/
    http://cloudflare.com
    https://ddos-guard.net – used by rt.com
    https://path.net/

    DDoS Protected Hosting

    https://www.hyperfilter.com – DDoS protected hosting
    https://koddos.net

    Back to DDoS

  • DDoS

    DDoS Protection Service
    Apache Website not loading – DDoS

    To check if your server is getting DDoS, you can use netstat command.

    netstat -anp | grep 'tcp' | awk '{print $5}' | cut -d: -f1 | sort| uniq -c | sort -n

    Or

    netstat -lantp|egrep ":80 "|awk '{print $5}'|cut -d: -f1|sort|uniq -c|sort -nr|head
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
netstat -alpn | grep :80 | awk '{print $4}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n

    Instead of netstat, you can also use ss command

    ss -tan state established | grep ":80\|:443" | awk '{print $4}' | cut -d':' -f1 | sort -n | uniq -c | sort -n

    Once you find the offending IP address, you can block it in the firewall.

    To Verify if an IP is blocked

    iptables -L -n | grep 'IP_ADDR_HERE'

    Block Attack with CSF firewall

    vi /etc/csf/csf.conf

    Set CT_LIMIT to 30, set it back to 100 after attack stop.

    CT_LIMIT = "30"

    Set SYNFLOOD to 1, set it back to 0 after DDoS attack stop.

    SYNFLOOD = "1"