Re: How to limit the number of sessions per IP address (DOS attacks)

2012-09-30 Thread Brian Braun
Hi Constantine, 1- I had almost decided to program a filter. However, I have found this solution: http://stackoverflow.com/questions/3679465/find-number-of-active-sessions-created-from-a-given-client-ip/3679783#3679783 What do you think about it? I havent tried it yet, but as far as I can tell it

Re: high CPU usage on tomcat 7

2012-09-30 Thread mailingl...@j-b-s.de
Well, if you have 4 cores and all cores are looping tomcat definitely will not respond any more... Von meinem iPad gesendet Am 30.09.2012 um 12:42 schrieb Jeff MAURY : > I don't think a cpu loop will make tomcat stopping responding to requests > I will make it very slow to respond > But a short

Re: Security issue regarding JSESSIONID cookie

2012-09-30 Thread Konstantin Kolinko
2012/9/30 Konstantin Kolinko : > 2012/9/28 Christopher Schultz : >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Konstantin, >> >> On 9/28/12 10:27 AM, Konstantin Kolinko wrote: >>> 2012/9/28 Joan Morales : Hi, I have a security issue (hijack session) with JSESSIONID cookie

Re: high CPU usage on tomcat 7

2012-09-30 Thread Jeff MAURY
I don't think a cpu loop will make tomcat stopping responding to requests I will make it very slow to respond But a shortage on memory is hard to recover Jeff Le vendredi 28 septembre 2012, mailingl...@j-b-s.de a écrit : > Maybe an infinite loop? We observed something similar due to a bug in the

Re: maxHTTPHeaderSize, and specific header lengths

2012-09-30 Thread Konstantin Kolinko
2012/9/28 Andrew Todd : > I have a question about maxHttpHeaderSize [0]. In Apache httpd, there > are two different parameters that affect the maximum size of an HTTP > header, limitRequestFieldSize and limitRequestLine. [1] These > configuration values specify about 8 kilobytes per _line_ in the >

Re: Security issue regarding JSESSIONID cookie

2012-09-30 Thread Konstantin Kolinko
2012/9/28 Christopher Schultz : > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Konstantin, > > On 9/28/12 10:27 AM, Konstantin Kolinko wrote: >> 2012/9/28 Joan Morales : >>> Hi, >>> >>> I have a security issue (hijack session) with JSESSIONID cookie, >>> >>> here is the problem: >>> >>> I am

Re: How to limit the number of sessions per IP address (DOS attacks)

2012-09-30 Thread Konstantin Kolinko
2012/9/30 Brian Braun : > Hi, > > I'm using Tomcat 7.0.22 (+Ubuntu Linux + MySQL). > > I'm providen a geolocation service. My users invoque a URL in my server > (something like http://services.acme.com/locate?ip=..) providing the IP > address, and it responds with the geolocation info. This ser