For the life of me, I can't find the destination url mentioned on the stats page.
- Thread starter brettdavidsonnz
- Start date
LiteSpeed uses a more aggressive and more efficient way of handling dos attacks. When the IP source hits defined throttle ceilings, the request is stopped at earliest possible detection stage.. When an IP hits throttle, LiteSpeed doesn't waste any resources parsing that request's HTTP header/payload.
This is the reason why LiteSpeed does not log request destination of clients that are over the throttle limit.
Imagine a case of 100 simultaneous 1MB HTTP POST attack by a single DoS source. Why bother even parsing any part of the request. If it's over the connection/bandwidth limit, just deny the request.
Apache gave you the http destination because it just wasted resources parsing a payload that's already a security risk to begin with.
This is the reason why LiteSpeed does not log request destination of clients that are over the throttle limit.
Imagine a case of 100 simultaneous 1MB HTTP POST attack by a single DoS source. Why bother even parsing any part of the request. If it's over the connection/bandwidth limit, just deny the request.
Apache gave you the http destination because it just wasted resources parsing a payload that's already a security risk to begin with.
LiteSpeed mainly deal with DDoS attack automatically based on various throttling limit. No manual check needed under attack. The IPs hitting the limit has been logged in error.log .
Next release, we will add an option to block bad IPs with firewalls automatically, so the bots not even able to reach the web server port any more.
We plan to add content based DDoS detection in our advanced Anti-DDoS product, our current anti-DDoS feature is already the most powerful solution implemented inside a web server.
Next release, we will add an option to block bad IPs with firewalls automatically, so the bots not even able to reach the web server port any more.
We plan to add content based DDoS detection in our advanced Anti-DDoS product, our current anti-DDoS feature is already the most powerful solution implemented inside a web server.
mistwang, while you are at it: how about something like a sliding window? e.g. having 10 requests in 10 seconds or something. I wouldn't want to block someone with more than one request per second as this can happen but if it happens for more than a couple of seconds ... 
.
also I'd like to configure exceptions for the limits e.g. for benchmarks or special ip-ranges (I don't want to stop the google crawler from indexing ...).
yes, currently I'm doing all this in the php-scripts accessed but would be nice to have it in the webserver itself.
.also I'd like to configure exceptions for the limits e.g. for benchmarks or special ip-ranges (I don't want to stop the google crawler from indexing ...
).yes, currently I'm doing all this in the php-scripts accessed but would be nice to have it in the webserver itself.
Request rate limit only slow it down, will not result in being blocked.
Only when number of connections reach the limit, it will be banned.
Adding IP/subnet to trusted IP list at server level access control will bypass all per IP throttling.
So, current litespeed can do pretty much what you need now.
Only when number of connections reach the limit, it will be banned.
Adding IP/subnet to trusted IP list at server level access control will bypass all per IP throttling.
So, current litespeed can do pretty much what you need now.
I know, thats really going offtopic now but I just want to continue that.
Where's the "Trusted IP list"? Do you mean the allowed list in access control?
Edit: oh, found the explanation in the docs for allowed list in access control
Also how would I implement my above requirement with raw lsws?
I want to limit requests to dynamic content to ~20 requests per 10 seconds - mainly for kicking agressive offline-browsing tools.
Static content can be downloaded with as many requests as wanted (don't have large static content, just some icons/images).
Where's the "Trusted IP list"? Do you mean the allowed list in access control?
Edit: oh, found the explanation in the docs for allowed list in access control
Also how would I implement my above requirement with raw lsws?
I want to limit requests to dynamic content to ~20 requests per 10 seconds - mainly for kicking agressive offline-browsing tools.
Static content can be downloaded with as many requests as wanted (don't have large static content, just some icons/images).