Re: [PHP] PHP Denial of service

2006-10-16 Thread Curt Zirzow
On 10/16/06, Richard Lynch <[EMAIL PROTECTED]> wrote: On Fri, October 13, 2006 4:16 pm, Ryan Barclay wrote: > A simple question I imagine, but I am wondering how I would combat DoS > attacks by users holding the REFRESH key on their browsers? > > I have reproduced this error on a PHP-MYSQL websit

Re: [PHP] PHP Denial of service

2006-10-16 Thread Curt Zirzow
On 10/14/06, Ryan Barclay <[EMAIL PROTECTED]> wrote: It hasn't actually been attempted. However, if a couple of a users were to hold the refresh, the page generation times would go up ridiculously and clients would be waiting over 20sec for pages. As mentioned, it's a very heavy php-mysql scrip

Re: [PHP] PHP Denial of service

2006-10-16 Thread Richard Lynch
On Fri, October 13, 2006 4:16 pm, Ryan Barclay wrote: > A simple question I imagine, but I am wondering how I would combat DoS > attacks by users holding the REFRESH key on their browsers? > > I have reproduced this error on a PHP-MYSQL website and when I hold > the > REFRESH key on for a while, pa

Re: [PHP] PHP Denial of service

2006-10-14 Thread Ed Lazor
On Oct 14, 2006, at 4:05 AM, Ryan Barclay wrote: It hasn't actually been attempted. However, if a couple of a users were to hold the refresh, the page generation times would go up ridiculously and clients would be waiting over 20sec for pages. As mentioned, it's a very heavy php-mysql sc

Re: [PHP] PHP Denial of service

2006-10-14 Thread Roman Neuhauser
# [EMAIL PROTECTED] / 2006-10-13 22:16:18 +0100: > A simple question I imagine, but I am wondering how I would combat DoS > attacks by users holding the REFRESH key on their browsers? > > I have reproduced this error on a PHP-MYSQL website and when I hold the > REFRESH key on for a while, page g

Re: [PHP] PHP Denial of service

2006-10-14 Thread Ryan Barclay
It hasn't actually been attempted. However, if a couple of a users were to hold the refresh, the page generation times would go up ridiculously and clients would be waiting over 20sec for pages. As mentioned, it's a very heavy php-mysql script with lots of queries. Ryan -- Ryan Barclay RBF

Re: [PHP] PHP Denial of service

2006-10-14 Thread Ryan Barclay
Jon, Thanks for the reply. Yes, ignore_abort is defaulting to off, as stated in my other post. We have a Firebox III 1000 firewall on our external, however this does not have any features like this. I will look into iptables. Thanks, Ryan -- Ryan Barclay RBFTP Networks Ltd. DDI: +44 (

Re: [PHP] PHP Denial of service

2006-10-14 Thread Ryan Barclay
I have just run a phpinfo and ignore_user_abort is indeed defaulting to off. It's a pretty heavy php-MySQL script. I noticed on scripts without the MySQL interaction, the server can keep up much better with the forced refreshes. Are there any other liming settings I can change? All the bes

Re: [PHP] PHP Denial of service

2006-10-13 Thread Ed Lazor
On Oct 13, 2006, at 2:16 PM, Ryan Barclay wrote: A simple question I imagine, but I am wondering how I would combat DoS attacks by users holding the REFRESH key on their browsers? I have reproduced this error on a PHP-MYSQL website and when I hold the REFRESH key on for a while, page gen t

Re: [PHP] PHP Denial of service

2006-10-13 Thread Jon Anderson
Ryan Barclay wrote: Thanks for the reply. I can't seem to find ignore_user_abort in my php.ini. I would like to do it at server level, rather than individual scripts. Do you know roughly where is it? I think there were some versions with this missing in the ini, which was later fixed. I'm

Re: [PHP] PHP Denial of service

2006-10-13 Thread Robert Cummings
On Sat, 2006-10-14 at 01:25 +0100, Ryan Barclay wrote: > Robert, > > Thanks for the reply. I can't seem to find ignore_user_abort in my > php.ini. I would like to do it at server level, rather than individual > scripts. Do you know roughly where is it? I think there were some > versions wit

Re: [PHP] PHP Denial of service

2006-10-13 Thread Ryan Barclay
Robert, Thanks for the reply. I can't seem to find ignore_user_abort in my php.ini. I would like to do it at server level, rather than individual scripts. Do you know roughly where is it? I think there were some versions with this missing in the ini, which was later fixed. I'm guessing t

Re: [PHP] PHP Denial of service

2006-10-13 Thread Ryan Barclay
Robert, Thanks for the reply. I can't seem to find ignore_user_abort in my php.ini. I would like to do it at server level, rather than individual scripts. Do you know roughly where is it? I think there were some versions with this missing in the ini, which was later fixed. I'm guessing t

Re: [PHP] PHP Denial of service

2006-10-13 Thread Robert Cummings
On Fri, 2006-10-13 at 22:16 +0100, Ryan Barclay wrote: > A simple question I imagine, but I am wondering how I would combat DoS > attacks by users holding the REFRESH key on their browsers? > > I have reproduced this error on a PHP-MYSQL website and when I hold the > REFRESH key on for a while,

[PHP] PHP Denial of service

2006-10-13 Thread Ryan Barclay
A simple question I imagine, but I am wondering how I would combat DoS attacks by users holding the REFRESH key on their browsers? I have reproduced this error on a PHP-MYSQL website and when I hold the REFRESH key on for a while, page gen times shoot up dramatically and hundreds of processes

Re: [PHP] php, denial of service attack

2003-09-08 Thread John W. Holmes
nabil wrote: I have a postnuke website and i had denial of service attack the point is the attack is one only the home php page ... with cpu 100% and few apache procceses.. Any comment ? It was not me. -- ---John Holmes... Amazon Wishlist: www.amazon.com/o/registry/3BEXC84AB3A5E/ php|architect:

[PHP] php, denial of service attack

2003-09-07 Thread nabil
I have a postnuke website and i had denial of service attack the point is the attack is one only the home php page ... with cpu 100% and few apache procceses.. Any comment ? -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php