[cobalt-users] DoS on RaQ4 Apache

[Glenn Parsons <gparsons@xxxxxxxxxxxxx>]

Hello All,

I had a DoS last night on my Apache server. The attack looks like this:

hostname.domain-name.com 209.249.75.253 - - [19/Mar/2004:21:53:03 -0500] 
"-" 408 - "-"
"-"

in the /var/log/httpd/access file. Nothing is noted in the 
/var/log/httpd/error log.

The attack causes Apache to eventually spawn too many threads. You can see 
the Apache threads running away with the machine performing a 'ps aux' 
during the attack.

My RaQ is not fully patched, but all the relevant Apache patches are applied.

Any ideas? Has anyone seen this?

Thanks,
Glenn