DoS attack in the wild

[Igor Sysoev]

On Sat, Jun 20, 2009 at 04:41:48PM +0400, Igor Sysoev wrote:

> On Sat, Jun 20, 2009 at 03:33:40PM +0300, luben karavelov wrote:
> 
> > J??r??me Loyet wrote:
> > >this attack works great on apache but I was unable, yet, to make it
> > >works on nginx (0.8.3).
> > >
> > 
> > On nginx it exhuases the available sockets. My setup is nginx-0.7.58 
> > with cofig: :
> > 
> > worker_processes  4;
> > worker_rlimit_nofile 5000;
> > events {
> >     worker_connections  2048;
> >     use epoll;
> > }
> > 
> > 
> > and without the fixes I could DoS the server with:
> > ./slowloris.pl -dns photomoment.bg -timeout 30 -num 10000 -tcpto 5
> > 
> > exhausts available sockets and the server stops replying to new requests.
> 
> 5000 and 2048 are too small values in modern Internet, I use usually
> about 200,000.
> 
> You need to increase
> 1) OS sockets limit,
> 2) OS network memory limits (buffers, etc.)

By buffers I meant not increasing send/receive buffers limits: actually,
you should decrease them. I meant a total number of memory dedicated
to the buffers by kernel.

> 3) OS files limit,
> 4) OS per process files limit (worker_rlimit_nofile),
> 5) and finally, nginx's worker_connections.
> 
> 
> -- 
> Igor Sysoev
> http://sysoev.ru/en/

-- 
Igor Sysoev
http://sysoev.ru/en/