Re: Apache "DDOS" with random number request

[Michael Loftis <mloftis@modwest.com>]

It sounds liek your app, or a combination of the modules you're using is 
more likely what's running Apache out of memory.  mod_security could be 
used to check for requests that contain just a numeric path to GET, but I'd 
investigate why your app/configuration is causing an OOM error.  Could it 
be you've got MaxClients set too high and the clients are holding 
connections open after the fact?

There are many possibilities at this point, many of which (most) have 
nothing to do with apache but with local configuration and options.

--On September 22, 2008 12:08:39 AM +0200 NeMiX <NeMiX@freakmail.de> wrote:

> Hi there,
>
>
>
> since last week we´ve got a little problem with our Webserverfarm.
>
> We get some strange Request from some Dial-Up Accounts from Europe
> (T-Online; Telefonica; Orange...):
>
>
>
> Sep 21 22:47:35 logger: [Sun Sep 21 22:47:35 2008] [error] [client
> 87.183.65.xx] Invalid URI in request GET 347905 HTTP/1.0 Sep 21 22:47:35
> logger: [Sun Sep 21 22:47:35 2008] [error] [client 87.183.65.xx] Invalid
> URI in request GET 341922 HTTP/1.0
>
>
>
> This strange Request (GET 347905 HTTP/1.0 ) pass our Firewall (because
> it´s normal HTTP), goes to our Load balancer and then to our Webserver.
>
>
>
> Only 1 Client make about 80-100 strange Request per Minute and we get a
> peak on our Webserverfarm and finally after 5 Minutes the Webserver(s)
> get out of memory:
>
>
>
> Out of Memory: Kill process 12082 (apache) score 199722 and children.
>
> Out of memory: Killed process 19435 (apache).
>
>
>
> If we get a "DDOS" we make a tcpdump and count the IPs (maximum 8 Dial Up
> Accounts) to block them on our Firewall.
>
>
>
> I don´t find any about this strange request on Google or some security
> boards.
>
>
>
> Is this a new kind of DDOS or just kiddy stuff? If someone have some more
> information about this strange Request/DDOS it would be very nice if he
> can send this to me.
>
>
>
> Kind Regards
>
>
>
> --
>
> Andre Braun, IT Manager
>
>
>
> Turtle Entertainment GmbH



--
Michael Loftis
Modwest Operations Manager
Powerful, Affordable Web Hosting