4

I have a network dump (PCAP file) from a "conversation" between a web server apache (192.168.1.2) and some clients:

PCAP File

What a should look for to prove that the server buffer (or TCP WINDOW) is full? I received 403 error (error.log). I know it was a denial of service attack (slowloris).

  • Please explain more about your config: 1. Are you located on the apache server, on any in-the-middle router or elsewhere? 2. What kind of os are you using a) on server, b) where you're located. – F. Hauri May 12 '17 at 13:38
  • ... and what's your goal: learning something, prevent attacks or to build some honeypot? – F. Hauri May 12 '17 at 13:45
  • @F. Hauri: Thanks. This simulation is part of a reserch project about denial of service.My goal is understand the attack! – Ed S May 12 '17 at 14:09
  • ... And what about your environment? ... and please instead of answering to comments, edit your request! – F. Hauri May 12 '17 at 14:30
1
+50

With .pcap file

Unfortunely, you can't ask for server status, while just looking for communication line.

But, you could count how many different connection are opened by one ip:

/usr/sbin/tcpdump -anr myfile.pcap |
    sed 's/^.*IP \([^:]*\)192.168.1.2.80:.*/\1/p;d' |
    sort |
    uniq -c

This will show a lot of

          10 192.168.1.8.36684 >
           4 192.168.1.8.39619 >
           9 192.168.1.8.39856 >
           4 192.168.1.8.39896 >
           5 192.168.1.8.40195 >
          12 192.168.1.8.40196 >
           9 192.168.1.8.52288 >
           7 192.168.1.8.58529 >
           9 192.168.1.8.58639 >
           9 192.168.1.8.58730 >
           6 192.168.1.8.58835 >
          13 192.168.1.8.58851 >
          12 192.168.1.8.58852 >
          10 192.168.1.8.58882 >

You could try to count how many connection per seconds, but how many maintened open connection is stronger.

Near real time

If located on a proxy, a router or the server himself, you could trace real time connections with

tcpdump -ani eth0 host 192.168.1.2 and port 80 |
    sed -une '
      s/^\(.\{8\}\).* IP \(.*\)\.[0-9]\+ > 192.168.1.2.80: Flags \[S\],.*/\1 \2/p
    '

If too much output, you could count connection by sec, with a little delay due to uniq bufferisation and count

tcpdump -ani eth0 host 192.168.1.2 and port 80 |
    sed -une '
      s/^\(.\{8\}\).* IP \(.*\)\.[0-9]\+ > 192.168.1.2.80: Flags \[S\],.*/\1 \2/p
    ' |
    uniq -c

Next step

If based on Linux, you may start to play with iptables to build triggers for this kind of attacks, have a look there:

How to best defend against a “slowloris” DOS attack against an Apache web server? @ serverfault.com

  • :"You could try to count how many connection per seconds, but how many maintened open connection is stronger". How can I do it using Python. for example? Thanks! – Ed S May 12 '17 at 12:49
  • If on server, you could use netstat but on intermediate router, there is no way. – F. Hauri May 12 '17 at 13:03
  • ( I'm not 100% sure about previous comment. I have to confirm them... ) – F. Hauri May 12 '17 at 13:06
  • "You could try to count how many connection per seconds, but how many maintened open connection is stronger" But, is it possible after the attack? or can I look into the PCAP file? – Ed S May 12 '17 at 13:31
  • 1
    ... You may replace uniq -c by sort | uniq -c. – F. Hauri May 17 '17 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.