4

I have a network dump (PCAP file) from a "conversation" between a web server apache (192.168.1.2) and some clients:

PCAP File

What a should look for to prove that the server buffer (or TCP WINDOW) is full? I received 403 error (error.log). I know it was a denial of service attack (slowloris).

4
  • Please explain more about your config: 1. Are you located on the apache server, on any in-the-middle router or elsewhere? 2. What kind of os are you using a) on server, b) where you're located. May 12, 2017 at 13:38
  • ... and what's your goal: learning something, prevent attacks or to build some honeypot? May 12, 2017 at 13:45
  • @F. Hauri: Thanks. This simulation is part of a reserch project about denial of service.My goal is understand the attack!
    – Ed S
    May 12, 2017 at 14:09
  • ... And what about your environment? ... and please instead of answering to comments, edit your request! May 12, 2017 at 14:30

1 Answer 1

1
+50

With .pcap file

Unfortunely, you can't ask for server status, while just looking for communication line.

But, you could count how many different connection are opened by one ip:

/usr/sbin/tcpdump -anr myfile.pcap |
    sed 's/^.*IP \([^:]*\)192.168.1.2.80:.*/\1/p;d' |
    sort |
    uniq -c

This will show a lot of

          10 192.168.1.8.36684 >
           4 192.168.1.8.39619 >
           9 192.168.1.8.39856 >
           4 192.168.1.8.39896 >
           5 192.168.1.8.40195 >
          12 192.168.1.8.40196 >
           9 192.168.1.8.52288 >
           7 192.168.1.8.58529 >
           9 192.168.1.8.58639 >
           9 192.168.1.8.58730 >
           6 192.168.1.8.58835 >
          13 192.168.1.8.58851 >
          12 192.168.1.8.58852 >
          10 192.168.1.8.58882 >

You could try to count how many connection per seconds, but how many maintened open connection is stronger.

Near real time

If located on a proxy, a router or the server himself, you could trace real time connections with

tcpdump -ani eth0 host 192.168.1.2 and port 80 |
    sed -une '
      s/^\(.\{8\}\).* IP \(.*\)\.[0-9]\+ > 192.168.1.2.80: Flags \[S\],.*/\1 \2/p
    '

If too much output, you could count connection by sec, with a little delay due to uniq bufferisation and count

tcpdump -ani eth0 host 192.168.1.2 and port 80 |
    sed -une '
      s/^\(.\{8\}\).* IP \(.*\)\.[0-9]\+ > 192.168.1.2.80: Flags \[S\],.*/\1 \2/p
    ' |
    uniq -c

Next step

If based on Linux, you may start to play with iptables to build triggers for this kind of attacks, have a look there:

How to best defend against a “slowloris” DOS attack against an Apache web server? @ serverfault.com

13
  • :"You could try to count how many connection per seconds, but how many maintened open connection is stronger". How can I do it using Python. for example? Thanks!
    – Ed S
    May 12, 2017 at 12:49
  • If on server, you could use netstat but on intermediate router, there is no way. May 12, 2017 at 13:03
  • ( I'm not 100% sure about previous comment. I have to confirm them... ) May 12, 2017 at 13:06
  • "You could try to count how many connection per seconds, but how many maintened open connection is stronger" But, is it possible after the attack? or can I look into the PCAP file?
    – Ed S
    May 12, 2017 at 13:31
  • 1
    ... You may replace uniq -c by sort | uniq -c. May 17, 2017 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .