Page 1 of 1

F5 attack?

Posted: Mon Oct 16, 2006 9:33 pm
by evilmonkey
Hi everyone,

I have a dedicated server, and it seems my server has been victim of an 'F5 attack'. I am looking at the number of requests apache process simoultaniously. Normally, it's 10-30, but it sometimes jumps to 500+ and kills my server (most of the connections are "sending reply" or "keepalive"). I am forced to restart httpd each time that happens. Seems to me that causing something like this is as simple as holding down the F5 key while on a page, while more complicated methods (such as JournalMacro) can be much more effective at the task of killing my Apache server. What can I do about this? Thanks. :)

Posted: Mon Oct 16, 2006 10:04 pm
by hawleyjr
I'd start with blocking the IP address the attack is coming from.

Posted: Mon Oct 16, 2006 10:06 pm
by evilmonkey
How can I do that automatically (and prevent my site from doing down)?

Posted: Mon Oct 16, 2006 10:28 pm
by evilmonkey
I made a mistake. Most of the offennding packets are K or R (mostly R), so they're requests.