How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to "cool" him off. Any ideas on how it's done?

2 Answers 2


On *nix, you can use fail2ban with a something like this in your jail.conf (100 requests in 30 seconds means a 5 minute ban). Of course, you'll have to adjust this for how many requests you expect from a legitimate user -- as @Jeff Ferland points out in the comments below, you need to account for the number of requests that you receive on a normal page load (e.g. you have a lot of images on the page).


enabled = true
banaction = apache
port    = http,https
filter  = apache-spammer
logpath = /srv/*/log/access.log
maxretry = 100
findtime = 30
bantime = 300

and a filter like this in /etc/fail2ban/filter.d/apache-spammer.conf:


# Option:  failregex
# Notes.:  regex to match the request messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
failregex = ^<HOST>.*/path/to/content.html

This is untested -- you'll have to experiment a bit to find what works. Watch your fail2ban.log to verify that you aren't banning innocent users!

An alternative would be a firewall rule that rate-limits requests from a particular IP address.

  • See also: serverfault.com/questions/208341/…
    – bstpierre
    Commented Dec 19, 2011 at 21:55
  • 10 requests in 30 seconds is far too low, and that will match 10 requests of anything. Load a page with 9 images on it once and you're in the doghouse for five minutes.
    – Jeff Ferland
    Commented Dec 19, 2011 at 21:55
  • and: serverfault.com/questions/310599/…
    – bstpierre
    Commented Dec 19, 2011 at 21:56
  • 1
    @JeffFerland: I don't think so: the regex in the filter file will only match the URL(s) that you specify. So an innocent user requesting 200 images+scripts+css all at once won't be affected, just the malicious request for the same "content.html" 10 times in 30 seconds (or whatever N times in M seconds the OP wants to set as a bound). Just as long as the filter file doesn't specify a broad wildcard to match all the embedded content that an innocent user is going to pull on each page load.
    – bstpierre
    Commented Dec 19, 2011 at 22:07

Would mod_evasive be what you're looking for? It's focused on DoS attacks and limits the number of requests to a page per second. Otherwise, you might be able to adapt fail2ban to help out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .