3 ms·
50-100 requests per second doesn't sound like an attack (or at least not a very scary one, depending on request size...), more like a crawler or prefetcher gone
by mdb31 13y ago
50-100 requests per second doesn't sound like an attack (or at least not a very scary one, depending on request size...), more like a crawler or prefetcher gone haywire.
Anyway, best way to figure out what's going on, is to generate a distinct list of IPs originating the bad traffic from your logs, and block those addresses at your firewall. If this doesn't stop the strange requests in 15 minutes or so, you may want to get some expert help.
Your hosting provider may be able to be of some assistance here, but that greatly depends on their level of clue: many budget providers will just drop you at the first sign of denial-of-service related trouble, so do keep that in mind.
Signing up for a specialized service like Cloudflare is probably your best bet, and should be pretty affordable as well (their web site lists their business plan with "advanced denial of service attack mitigation" as $200/month, and they suggest that if you call them they can have you protected pretty much immediately).
- panabee 13y agothanks for the suggestion! we're using singlehop ... definitely not a budget hosting provider. these requests have been ongoing since yesterday morning (~36 hours). we looked at cloudflare earlier today. do you have experience with them? does the solution really work?
- mdb31 13y agoNo personal experience with deploying Cloudflare, but they're pretty widely used (including by the very site you're on right now), so if you're really having urgent issues, I'd definitely give them a call.
- mbijon 13y agoCloudflare's plans that include DDoS protection are as good or better than typical hosting resellers. May not know enough about your site to make the decisions a good datacenter team could though. On the up-side Cloudflare really is there 24/7. Unfortunately the advanced DDoS support is only in their upper $$ plans. Might be worth it to keep your site revenue going though.