This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting console to get it up and running again.
It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs.
I've pinpointed a potential cause, but I'm not sure if this was the cause. This morning between 3:27:58 and 3:28:00 there were 519 TLS handshake attempts that ping up as errors within the windows system logs, I haven't seen any successful connection attempts in the IIS website logs in this time frame for requesting a page.
The TLS handshakes varied from TLS 1.0 and 1.2
A collection of the error messages
- An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
- An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
- The following fatal alert was generated: 40. The internal error state is 1205.
Repeating over and over for those three seconds that it took.
Sadly I don't see any port details or IP addresses that attempted this so I don't even know if this was a webserver attack or an attack on another service.
Was this a DDOS attack? Is this attack signature known for a certain type of attack? And what can I do to mitigate future server chocking up because of these requests?