06-23-2011 12:29 PM - edited 03-10-2019 05:23 AM
Please guide the solutions for DDOS attack. I am facing this attack and after some investigation I found some details what is up against me
Here are some details of the attack which is most similar in my situation.
____________________________________________________________________________________________________________________________
In considering the ramifications of a slow denial of service attack against particular services, rather than flooding networks, a concept emerged that would allow a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports. The ideal situation for many denial of service attacks is where all other services remain intact but the webserver itself is completely inaccessible. Slowloris was born from this concept, and is therefore relatively very stealthy compared to most flooding tools.
Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they'll allow. Slowloris must wait for all the sockets to become available before it's successful at consuming them, so if it's a high traffic website, it may take a while for the site to free up it's sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they'll still be able to see the site. So it's a bit of a race condition, but one that Slowloris will eventually always win - and sooner than later.
Slowloris also has a few stealth features built into it. Firstly, it can be changed to send different host headers, if your target is a virtual host and logs are stored seperately per virtual host. But most importantly, while the attack is underway, the log file won't be written until the request is completed. So you can keep a server down for minutes at a time without a single log file entry showing up to warn someone who might watching in that instant. Of course once your attack stops or once the session gets shut down there will be several hundred 400 errors in the web server logs. That's unavoidable as Slowloris sits today, although it may be possible to turn them into 200 OK messages instead by completing a valid request, but Slowloris doesn't yet do that.
____________________________________________________________________________________________________________________________
Please suggest any solutions with product that can help to prevent this problem with some guidance of the feature of that product to specifically prevent this type of attack. I already a many cisco devices like ASA, IPS, Cisco guard etc. just need some guidance
An early response requested and it will be highly appreciated.
06-28-2011 02:07 AM
Hello Haseen
Any tool will have some sort of trend/chracterstic that can be used to filter or throttle it out. Take skype for an example; even with all its complexity vendors managed to find days to detect it on the network and take corrective actions. However its always a catch-up game, developers continually work to make their applications or protocols more stealthy and the vendors have to keep up with this challenge.
So you would need to understand this trend/chracterstic of the attack, and then filter out using an access control mechanism, IMHO the most appropriate would be a web application firewall (WAF), Cisco used to have one but I think it is EOS soon:
http://www.cisco.com/en/US/products/ps9586/index.html
F5 Networks have their ASM module:
http://www.f5.com/products/big-ip/application-security-manager.html
Other vendors also have some good tools.
Please rate if you find the applications helpful.
Regards
Farrukh
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide