Home / server / Questions / 316794
Accepted
Jérôme Verstrynge
Asked: 2011-09-30 04:05:50 +0800 CST

IP Address filter 'before' http secured connections for protection against DDoS attacks? [duplicate]

  • 772

One technique to protect against DDoS attacks is to monitor the number or requests per seconds coming from a given IP address. Of course, IP addresses can be fakes, but let's assume this is not an issue here.

A web application installed on Tomcat (for example) can be configured to use secured http connections only (i.e., https). I am not a sysadmin expert, but I believe that in case of a DDoS attack, the high number of https connections attempts could create 100% CPU spikes.

My questions are:

  1. Do DDoS attacks on https create long 100% CPU spikes?

  2. Is it possible to implement a software filter to monitor requests-per-seconds before the SSL negotiation is started in order to avoid long 100% CPU spikes?

  3. If answer to 2. is yes, can this be integrated in Tomcat? If yes how? Or it there a better solution out there?

Thanks.

EDIT

If answer to 2. is yes (but not in Tomcat), what solutions are available out there?

tomcat ddos https filtering

2 Answers

  1. Best Answer

    Ubuntu's ufw tool has a limit option that limits a service to 6 connections per IP address per 30 seconds. You can also use iptables.

    Many of the examples are for limiting ssh, but just changing the port should do it.

    • 1

  2. If you're trying to block attacks look into ConfigServer Security & Firewall. It manages iptables to set up rules to block attacks. It even installs into your WHM automatically (if you're on a WHM system).

    Here is where you'll find the free version.

    • 1