Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory use under Linux? Basically, I'd like timestamped physical memory, buffers/cache, and swap usage statistics in 1-second intervals during various DDoS attacks.

These can be generated by issuing the following command in BASH:

while (true) do\
    echo -n `date +%s.%N`;\
    free | awk '!/shared/ { ORS=""; print "\t" $3 "\t" $4; }';\
    sleep 0.99;\
done >> ~/memory_use_log.csv &

I ask, because I have realized that my program - swapd ( http://cvs.linux.hr/swapd/, http://archive.debian.org/debian/pool/main/s/swapd/, http://packages.ubuntu.com/maverick/swapd, http://www.linuxcertif.com/man/8/swapd/, ... ) - has found new use on cheap low-memory-low-disk-space Virtual Private Servers (VPS), so I am considering implementing the Allocation Vector technology that I invented in 2001, but never implemented into swapd as swapds' use was subsiding with increasing memory and disk space availability.

It has also occured to me that maybe some DDoS tools have considerable effect on memory use under Linux. Before I released swapd in 2000, I tested its' local-attack tolerance by allocating memory at several MiB/s on a Pentium II - I could only slow down the system, but not crash it. So, I'd like to know how various DDoS tools effect memory use under Linux so that I can implement a counter-mechanism when implementing Allocation Vector technology, after which swapd (to be renamed to dswapd) will no longer require swap file size etc. parameters and, basically, any beginner will be able to use it just by specifying directories and maximum allowed disk space use per directory - everything else will be determined using Allocation Vector technology.

  • Once swapping begins, heavy I/O could make the system unusable until the OOM killer fires. IMHO server should be able to provide enough memory for the offered service slots.
    – mspasov
    Feb 20, 2012 at 22:27

1 Answer 1


DDoS, or Distributed Denial of Service attacks are generally not meant to exploit a bug in code, but rather simply flood the host with packets, causing a denial of service either by saturating the connection to the box or by causing the machine to use all the CPU trying to process the amount of data coming in, the latter being more common on SSL (HTTPS) websites since the CPU must also decrypt/encrypt data streams.

HOIC and LOIC are essentially user-installed botnets that allow you to let your machine participate in a DDoS. These are attacks which are tough to defend.

Slowlaris and Pylaris are Denial of Service attacks which exploit the logic of the webserver. They cause a denial of service by opening a connection and leaving it open until it essentially times out, and by opening many at once and leaving them open the webserver hits a maximum connection number and stop accepting new connections until someone disconnects.

In 2011 a bug was found in Apache that was exploited to cause memory exhaustion.

From what I understand of your question, the short answer is on most webservers, DDoS effects on memory is negligible. I understand that VPS' are low memory, so write a short script to test it yourself.

Referring to your previous post, multiple subnets attacking does not change anything since it all still flows through the pipe.

  • Bug don't matter to me; I was thinking of non-bugs causing exhaustion - preprocessing of large amount of hypertext etc. The effects of multiple subnets attacking depend on whether you have a firewall or not.
    – nlovric
    Feb 18, 2012 at 6:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .