Attack site

[iDealhosting]

Hi,

I am being attacked by botnet and Litespeed cant stand.

log:

2009-01-08 18:45:56.300 NOTICE [78.181.144.239:3193-0#APVH_fullxxxxizlesene.com] Content len: 0, Request line:
GET /index.php?url=GLOBALE_OLUM HTTP/1.1
2009-01-08 18:45:56.300 INFO [78.181.144.239:3193-0#APVH_fullxxxxizlesene.com] HttpExtConnector state: 8, request body sent: 0, response body size: 0, response body sent:0, left in buffer: 0, attempts: 0.
2009-01-08 18:45:56.300 INFO [88.224.232.183:4648-0#APVH_fullxxxxizlesene.com] Connection idle time: 31 while in state: 5 watching for event: 24,close!
2009-01-08 18:45:56.300 NOTICE [88.224.232.183:4648-0#APVH_fullxxxxizlesene.com] Content len: 0, Request line:
GET /index.php?url=GLOBALE_OLUM HTTP/1.1
2009-01-08 18:45:56.300 INFO [88.224.232.183:4648-0#APVH_fullxxxxizlesene.com] HttpExtConnector state: 8, request body sent: 0, response body size: 0, response body sent:0, left in buffer: 0, attempts: 0.
2009-01-08 18:45:56.408 INFO [78.161.103.58:2000-0#APVH_fullxxxxizlesene.com] Connection idle time: 31 while in state: 5 watching for event: 24,close!
2009-01-08 18:45:56.408 NOTICE [78.161.103.58:2000-0#APVH_fullxxxxizlesene.com] Content len: 0, Request line:
GET /index.php?url=GLOBALE_OLUM HTTP/1.1


Any idea?

 

[mistwang]

check
http://www.litespeedtech.com/docs/webserver/config/security/#perClientConnLimit
and
http://www.litespeedtech.com/how-tos.html#qa_dos

 

[yulia]

I've taken botnets in the size of 40k with LS, so just do as mistwang says and keep playing with the connection limits till you get it just right. From experience, expect to spend a few hours on it.