Tor servers are killing my server

Portal Home > Knowledgebase > Articles Database > Tor servers are killing my server

Posted by RS Shamil, 08-24-2009, 01:19 PM
Hello, this early morning, my load averages hit 75. Upon investigation, the following server was hitting my server excessively: 68.168.208.220 olo27.com Now, Apache is failing, and looking upon error_log, I see: [Mon Aug 24 18:05:08 2009] [error] [client 213.155.4.70] request failed: error reading the headers A few hundred time.. and look at that IP: it resolves to olo29.com So, what do I do now, since I can't keep blocking the IP can I?
Posted by linuxfan, 08-24-2009, 02:02 PM
Maybe ddos_deflate will help,it block ip which connect a lot of time.
Posted by mooseweb, 08-24-2009, 03:27 PM
Tor will always be a problem for any website at some point, although DDoS Deflate should resolve your issue, just download it from MediaLayer and you'll be fine =) Set it to about 50 connections max at a time, if that doesn't work I'd go as low as 20, but then changing it higher later on.
Posted by RS Shamil, 08-24-2009, 05:12 PM
What we currently have is portflood implemented by CSF, and it seems to have stopped them so far.
Posted by RS Shamil, 08-25-2009, 01:19 AM
We're experiencing another attack, as soon as I get on, I'm installing DDoS Deflate.
Posted by MikeDVB, 08-25-2009, 01:24 AM
What kind of metrics are you seeing in the attack (number of simultaneous connections, number of IP's connecting)?