Mantriur

43 reputation

bio	website	atmoburn.com
	location	Chile
	age	39
visits	member for	3 months
	seen	Feb 15 at 15:56
stats	profile views	4

Got born, got drunk, stuck to the concept.

	43 reputation	bio	website	atmoburn.com	visits	member for	3 months
6 badges		location	Chile		seen	Feb 15 at 15:56

summary answers questions tags badges favorites bounties reputation activity

30 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 14	comment	Apache/Linux server, DoS attack from own IP I've updated the question with the solution. Unfortunately it's not spectacular at all, just a case of a complex system plus Alzheimer's. :/ Thanks for your help! :-)
Feb 13	revised	Apache/Linux server, DoS attack from own IP added 151 characters in body
Feb 13	comment	Apache/Linux server, DoS attack from own IP You are absolutely correct, just a bit late. :-D
Feb 13	awarded	Scholar
Feb 13	accepted	Apache/Linux server, DoS attack from own IP
Feb 13	revised	Apache/Linux server, DoS attack from own IP added 668 characters in body
Feb 13	awarded	Editor
Feb 13	revised	Apache/Linux server, DoS attack from own IP added 233 characters in body
Feb 13	comment	Apache/Linux server, DoS attack from own IP I'm using FilesMatch to give a specific png file the php type. Temporarily gave netstat an suid root to allow the webserver user to also log process IDs for all connections. That, plus the logged client port should identify the culprit. Assuming that it will be an apache process, I also activated mod_status and am appending that output as well. Anxiously waiting for the next occurence. :-D
Feb 13	comment	Apache/Linux server, DoS attack from own IP To elaborate on that last sloppy comment: I'm looking for both the cause and the intention. I'm not looking to cure the symptom, because that means there is still something on my box I don't understand. That would hurt my ego even more than having to ask for help here. :-D Well that, and it would still pose a security risk.
Feb 12	comment	Apache/Linux server, DoS attack from own IP Good point, but that's really a lot for someone who just happened to find a tool on the internet to do his bidding. Now that server runs a social media site that has its share of problems with weirdos and the ban mechanism is quite sophisticated, so I'm sure there's no lack of people with more motivation than knowledge. I'm going to implement Isernis idea and report back. :-)
Feb 12	comment	Apache/Linux server, DoS attack from own IP Great advice, thanks! There's a few images that are almost always part of the attack. I'll replace one of those with a script and see what I can find. :-) I agree that anything beyond a local process seems way too sophisticated for such a non-rewarding goal. AJ Henderson has a point when he says it might just be someone who uses a tool he doesn't understand, but there's just so much a script kiddie tool can do. I'm not really up to speed, but TCP sequence prediction used to be higher magic. :P Will report back! :-)
Feb 12	awarded	Supporter
Feb 12	comment	Apache/Linux server, DoS attack from own IP Sure, but what's the difference if I use htaccess or iptables?
Feb 12	comment	Apache/Linux server, DoS attack from own IP Wait, even if this was mod rewrite, there'd still be two requests, no? One from the original client, one causing the request from the server IP.
Feb 12	comment	Apache/Linux server, DoS attack from own IP I don't think rewrite is involved there. They hit both PHP files and images which are physically present and not being rewritten. I haven't confirmed this, but it is likely that the image urls are taken from the php script that's requested. They fit the folders ....
Feb 12	awarded	Commentator
Feb 12	comment	Apache/Linux server, DoS attack from own IP I'll need to add that trace to the script that blocks the address when it happens. Do you think it's actually realistic to run this with several thousand busy apache children? :(
Feb 12	comment	Apache/Linux server, DoS attack from own IP Sequence prediction would be a possibility. But it seems weird that someone would go through that trouble just to spoof the servers own address and then stop when that address gets blocked. Feels too professional for someone who is then stopped so easily. :)
Feb 12	comment	Apache/Linux server, DoS attack from own IP If another script causes this, wouldn't that script be called the same time these requests happen and show up in the access log? We're talking about 100 log entries per second with very few other and completely random requests happening at the same time.