DDOS Attacks

[eluser]Gewa[/eluser]
Hi all,
I hope my topic is interesting not only for me.
I see there is good XSS_CLEANing tool in CodeIgniter.
But I want to know how can I prevent from DDOS Attacks application written in CI...
Any experiece or ideas?

[eluser]pistolPete[/eluser]
DDoS attacks should be handled by hardware like firewalls and routers, I don't think any PHP script could help at all.

[eluser]Las3r[/eluser]
Correct Pete,

DDOS is litterly a flood of data towards a single ip address:

[ATTACKER] >>> [PACKETS] >>> [YOUR DATACENTER] >>>> [YOUR WEBSERVER]

The bottleneck (aka downtime-reason) is the [YOUR DATACENTER]. It get's spammed with megabits of traffic, so much that when you want to see your website, the webserver is still busy handling all the other connections, that services to you are denied (Ddos = Distributed Denial of service).

Quick comparison:

Let's say you have a phone at home. If 500.000 people call you at the same time, no matter how fast you answer - a lot of the calls will be getting the "busy-tone". Same for DDOS. A newer phone model (php protection , or CI in this case) won't help you anything, the bottleneck is in the phone line. If you get some more expensive hardware (CISCO Guard as a hardware firewall for example) you have more chance of blocking the attack (but large scale attacks will still be problematic).

I hope that answers your question.

Erik.

[eluser]gyo[/eluser]
If you're worried about a flood attack like loads of requests, you could create a script that bans the IP via htaccess after too many connections per seconds.

http://blamcast.net/articles/block-bots-...p-htaccess

Hope it helps!
gyo

[eluser]Las3r[/eluser]
Suashi, you are right, however it won't help if they ping your domain and litterly flood your ip ... flood never really go to a website or request html code. That's only when someone is _benchmarking_ your server with a million connections

[eluser]drewbee[/eluser]

That’s only when someone is _benchmarking_ your server with a million connections

Or when a search engine spider is going out of control ::looks at Slurp::

[eluser]gyo[/eluser]
Yeah Las3r, in that case it's only up to the hosting company to protect you against those attacks.

[eluser]Unknown[/eluser]
Have a look at GigabitDC.COM DDoS attack protection. They do cost effective dedicated hosted on their own network in Zurich.

[eluser]gyo[/eluser]
Just a quick thought... on a dedicated server you can install a firewall (or edit the already activated one)

[eluser]rvillalon[/eluser]
I recently came across an article talking about allowing users to embed images in forums and a potential DDOS attack that can take place. If I read it correctly, an attacker can perform multiple image uploads at a very slow transfer rate, creating a DDOS.

http://ez.no/es/developer/articles/dange...ng_be_done

Perhaps the biggest issue lies in the fact that having PHP download an external file is something that an attacker can abuse to launch a Denial of Service (DoS) attack against the server. To download a file, the first thing PHP needs to do is to establish a connection to a host server. If that server happens to be particularly slow, this can take a fair amount of time. During this time, the PHP process responsible for handling the request is waiting for a socket (a process that takes no CPU time, so maximum execution limit is not triggered). By default, this wait time lasts for a whooping 60 seconds, during which this process is unusable for operations. If every web server process can be made to perform the download, the server will become inaccessible to other users.

Can an attack like this be prevented using hardware?