Member Avatar for vibhaJ

I have mobile web services written in PHP. Ant it is running on Apache Linux. Suddenly since yesterday our server became too slow. We found the reason that there are many continuous connection is coming to our server. Which is engaging bandwidth and making server slow.

We have asked hosting provider GoDaddy to restrict some country from firewall but it is not suggested by them. I have tried with htaccess but it doesnt work. What is the idle solution for this?

  • 4 Contributors
  • 4 Replies
  • 221 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by vibhaJ

Dani AI

Generated

A concise, practical addendum that ties the thread’s suggestions together and gives immediate diagnostics + low-risk mitigations.

’s iptables idea and ’s suggestion to move filtering off the app server are both valid; was right to call out timeouts. First step is always classification — confirm whether the load is ICMP/SYN-level or application-layer HTTP floods. Quick commands that reveal top sources and active HTTP connections:

awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -nr | head -n 30
sudo netstat -anp | grep ':80\|:443' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head
sudo tcpdump -n -i eth0 'tcp dst port 80 or tcp dst port 443' -c 1000 -w /tmp/http-traffic.pcap

Once the attacker pattern is known, apply layered controls (start with the least disruptive):

  • Short-term, per-IP connection/rate limits with netfilter (example: limit concurrent connections and new-connection rate). Test rules from a console session that won’t lock out admins.
# limit concurrent connections per IP
iptables -I INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

# rate-limit new connections per source (hashlimit)
iptables -I INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -m hashlimit --hashlimit 30/min --hashlimit-burst 60 --hashlimit-mode srcip --hashlimit-name http_rate -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j DROP
  • Medium-term: use ipset + fail2ban to efficiently ban large lists, enable mod_evasive/mod_security or put an nginx/varnish reverse proxy in front to cache and throttle, and tune Apache (KeepAliveTimeout low, reasonable MaxRequestWorkers).
  • Long-term: for sustained/high-volume attacks, a CDN/DDoS-scrubbing provider or upstream filtering is the practical path. Collect pcap + access logs before engaging the host or vendor.

Cautions: test rules carefully (don’t lock out admin IPs), avoid overzealous GeoIP blocks (easy to bypass), and capture evidence for your hoster if you need upstream help.

Recommended Answers

All 4 Replies

Member Avatar for rubberman

You need to blacklist the source of the pings in your iptables configuration files. This will block all connection attempts by those sources. Read the iptables man pages for more information.

Member Avatar for CimmerianX

How about a reverse proxy or a Load Balancer on ther front end with your Web server on the back end. ICMPs are easily dropped at the proxy or LB while all web traffic is simply passed internally. Thus reducing load on the Web Server

Member Avatar for mmcdonald

What Linux Distro are you using? There are different settings available to set connection and session timeouts. You could, say, set a timeout to 600 seconds (10 minutes) and have the countdown for each connected session restart when the users intreracts with the web service. Therefore only active users would remain connected.

In Ubuntu, for example, there is a default 30 or 60 second tcp timeout - you can use a similar configuration for closing waste connections.

Member Avatar for vibhaJ

Thanks all for your answers. We finally got solution from "dosarrest". Any ping on server will be first passed to dosarresr and it will only redirect valid ping to our server and all spamm ping will be aborted. Though its costly but its working like a charm. Our website is faster than before. It may help someone who is comming to this thread for their problem.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.