NoodleX's questions

Recently my apache got DoS attack, it happened attacker flood SYN request to our apache, i know because at that time i have wireshark enabled.

After the attack finished, i restart my apache and its all back to run normal. But the problem when i check my serverstatus from mod-status there are some threads are showing

> 0-92 61968 0/0/674 R 1125 0 0.0 0.00 22.93 ? ? ..reading..
> 0-92 61968 0/0/29 R 537889 0 0.0 0.00 0.01 ? ? ..reading..
> 0-92 61968 0/0/852 R 1158 15 0.0 0.00 15.05 ? ? ..reading..
> 0-92 61968 0/0/2 R 537933 578 0.0 0.00 0.02 ? ? ..reading..
> 0-92 61968 0/0/3 R 537933 0 0.0 0.00 0.02 ? ? ..reading..
> 0-92 61968 0/0/1 R 538060 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/2 R 538060 0 0.0 0.00 0.01 ? ? ..reading..
> 0-92 61968 0/0/71 R 538146 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/31 R 538146 0 0.0 0.00 0.01 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 R 1287665833 0 0.0 0.00 0.00 ? ? ..reading..
> 0-92 61968 0/0/0 K 1287665833 0 0.0 0.00 0.00

these ..reading.. are always showing even after i restart. Do you have any idea how to remove this ? and where it comes from ?

Can someone provide me rules to detect following attack :

hping3 -S -p 80 --flood --rand-source [target]

I'm having problem with rules since packet comes from random source.

My current rules is :

alert tcp !$HOME_NET any -> $HOME_NET 80 (flags: S; msg:"Possible TCP DoS"; flow: stateless; threshold: type both, track by_src, count 70, seconds 10; sid:10001;rev:1;)

this rules only can detect from one source ip only.