LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: DoS protection strategies

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: DoS protection strategies
From: Roberto Nibali <ratz@xxxxxxxxxxxx>
Date: Tue, 18 Apr 2006 21:54:19 +0200
I agree that the ~1,000 simultaneous connection count is indeed the general breaking point for select()- or poll()-based web servers (in my experience), and epoll() is a much better solution as you say.

Too bad that apache only allows epoll for MPM event models. For the other interested readers, we're essentially talking about a feature which is best described here:

    http://www.kegel.com/c10k.html

Now, as for the memory pressure mentioned below, I beg to differ a bit ...

But Apache will not handle 1,000 simultaneous connections unless you have 4GB of RAM, you're on a 32-bit platform, and you have every feature turned off.

Why is that? I have rarely hit the problems serving 800-1000 concurrent sessions on 32bit using a normal 2G/2G-split 2.4.x or 2.6.x kernel. I'll try to get you a serverstats output from one of our customers tomorrow, if possible.

And then only if you don't want any disk buffer/cache. :)

Again, I believe that if you already hit the memory limits, you did something wrong in your configuration or setup :).

With typical application server support (e.g., mod_php), Apache will not reach 1000 processes without something like 8-16G of RAM.

Ohhh, the OP never talked about mod_php or even mod_perl for that matter. Both are memory hogs, but then again, if you use a proper m:n threading model, I bet you can still serve a couple of hundred concurrent connections.

I've never been able to set MaxClients above 200... Copy-on-write only goes so far.

I would argue that COW kills your performance because your application was not designed properly :). No pun intended, but I've more than once fixed rather broken web service architectures based on PHP or Servlets or JSP or ASP or <insert you favourite web service technology>.

May I ask what your average processing time of a typical deep link (non-static) pageview is?

Sorry for the tangent, but throttling/DoS prevention is especially important for any web/application server based on the process model.

DoS prevention does not exist, this topic has been beaten to death already :). DoS mitigation, maybe yes. Maybe we should define throttling before continuing discussing its pro/cons. It could very well be that we agree on that.

Thanks for your feedback and best regards,
Roberto Nibali, ratz
--
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

<Prev in Thread] Current Thread [Next in Thread>