0

This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting console to get it up and running again.

It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs.

I've pinpointed a potential cause, but I'm not sure if this was the cause. This morning between 3:27:58 and 3:28:00 there were 519 TLS handshake attempts that ping up as errors within the windows system logs, I haven't seen any successful connection attempts in the IIS website logs in this time frame for requesting a page.

The TLS handshakes varied from TLS 1.0 and 1.2

A collection of the error messages

  • An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
  • An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
  • The following fatal alert was generated: 40. The internal error state is 1205.

Repeating over and over for those three seconds that it took.

Sadly I don't see any port details or IP addresses that attempted this so I don't even know if this was a webserver attack or an attack on another service.

Was this a DDOS attack? Is this attack signature known for a certain type of attack? And what can I do to mitigate future server chocking up because of these requests?

1

It's not a DDoS.

It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs.

That's what the source of the traffic is. The SSL Labs scanner will make a large number of SSL/TLS handshakes in order to test for support of various ciphers and features.

  • Hmm, you seem to be right. I just did an SSL labs test and I came out at the same number of error messages ish. So someone triggered an SSLLabs test in the middle of the night forwhatever reason. Also confirmed that this didn't cause the slowdown as experienced. I have to keep digging then on what caused it. – Tschallacka Mar 5 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.