Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Logs show incoming attack? What is it?

Discussion in 'General Discussion' started by bmcpanel, Oct 24, 2002.

  1. bmcpanel

    bmcpanel Well-Known Member

    Joined:
    Jun 1, 2002
    Messages:
    546
    Likes Received:
    0
    Trophy Points:
    316
    One of my servers receives a barrage of attacks from a single IP about once per day. (See excerpt from logs below). It seems that they are using http to hit the server and the server sends a &408& error code.


    vi /usr/local/apache/logs/access_log
    -----------------
    61.129.81.37 - - [24/Oct/2002:16:58:29 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:29 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:29 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:30 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:30 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:30 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:30 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:30 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:31 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:31 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:31 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:31 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:31 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:31 -0400] &-& 408 -
    61.129.81.37 - - [24/Oct/2002:16:58:32 -0400] &-& 408 -
    -----------------

    This causes hundreds of HTTP processes to be spurned and the server bogs down and the load average goes up.

    I know how to block this once I find it by doing a &null route&. However, I dont even know what the hell this is? How is this asshole causing a &408& error? What is a 408 error?

    If anyone has any info, please let me know. If I have more info, maybe I can defeat this loser.
     
    #1 bmcpanel, Oct 24, 2002
  2. bmcpanel

    bmcpanel Well-Known Member

    Joined:
    Jun 1, 2002
    Messages:
    546
    Likes Received:
    0
    Trophy Points:
    316
    I'll bump this up because this is vital and will be useful to all. This seems to be a NEW type of DOS attack that causes the MaxClients error which causes Cpanel to generate an email to warn. It will cause legitimate http (web page) requests to fail and your customers will be pissed.

    Don't ignore this. This type of attack is commonly generated from China and seems to be either a DOS or an attempt to flood some buffer to get root access. I am not sure. If there is anyone with more info about this type of attack, please share with us.
     
    #2 bmcpanel, Oct 26, 2002
  3. Tom Pyles

    Tom Pyles Well-Known Member

    Joined:
    Apr 26, 2002
    Messages:
    254
    Likes Received:
    0
    Trophy Points:
    316
    Did you see this thread yet?
    http://216.118.116.105/read.php?TID=5350

    Other users are seeing it too...I've seeing it on our servers also. I've noticed in ours the attacks don't last long...
     
    #3 Tom Pyles, Oct 26, 2002
(You must log in or sign up to post here.)
Loading...
Similar Threads - Logs show incoming
  1. martin MHC

    Can WHM Update Logs actually show Files that have been updated

    martin MHC, Aug 31, 2017, in forum: General Discussion
    Replies:
    1
    Views:
    314
    cPanelMichael
    Aug 31, 2017
  2. galbaras

    Awstats shows hosts not in raw access logs

    galbaras, Jan 31, 2017, in forum: General Discussion
    Replies:
    4
    Views:
    1,087
    galbaras
    Feb 4, 2017
  3. natejasper

    DNSOnly Missing Logs

    natejasper, Mar 27, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    40
    cPanelMichael
    Mar 27, 2018
  4. HostMerit

    PHP error logs

    HostMerit, Mar 12, 2018, in forum: General Discussion
    Replies:
    6
    Views:
    101
    cPanelMichael
    Mar 12, 2018
  5. inspiredearth

    Per domain Apache Error Logs?

    inspiredearth, Mar 11, 2018, in forum: EasyApache
    Replies:
    6
    Views:
    140
    cPanelMichael
    Mar 14, 2018

Share This Page