CODEWITHSUNDEEP
network-programminghttpsssl
VoiceOfUnreason
VoiceOfUnreason

Reputation: 57377

Troubleshooting an SSL flood

Users connect to our webserver via https, and stay on a secured connection throughout their use of our service. A typical user session will establish a small handful of connections to the server (one or two).

There are a very small number of exceptions we are trying to track down. Particular users will intermittently have handfuls of hundreds of connections established. When we happen to catch the problem in the act, we can see the exchange of the SSL handshake, and from the perspective of the server, all appears to be in order. Yet we never observe a payload - the client instead connects on a new port and initiates a new handshake.

We do not have access to the client, and cannot observe the behavior from that side of the connection. Nor do we have a local scenario that can reproduce the problem.

It is our belief (though not confirmed) that the user agent is connecting to our server directly, and not through a proxy.

Does anybody recognize these symptoms? Can anyone suggest steps to further identify the problem?

Upvotes: 1

Views: 265

Answers (3)

Attila Lendvai
Attila Lendvai

Reputation: 1351

this is probably not your situation, but i thought i mention it.

i'm seeing chrome (12.0.742.60 beta) flooding my server with https connections, some half a dozen or more connections for a single static picture being served... as if it had an optimization to build up connections with ready https handshakes waiting for requests to send, and then after the page (file) has been served it closes them all.

on plain http i see only two connections (one extra for favicon.ico).

Upvotes: 0

Attila Lendvai
Attila Lendvai

Reputation: 1351

i've seen a botnet flooding https sites being mentoned.

Upvotes: 0

Christopher Orr
Christopher Orr

Reputation: 111625

Are there any patterns you can see to this traffic, aside from making many repeated requests?

For example, do the requests come from the same IP ranges? Possibly search engines or other spiders, or maybe from countries that you normally don't get users from, possibly indicating some sort of weird botnet or at least something you could block?

Do these rogue requests always negotiate to use a particular cipher suite, potentially indicating the client software?
Does it make any difference if you change the available cipher suites available for negotiation?

What server software are you using, and are there any firewalls within your network that could potentially be dropping some responses to the user?

Upvotes: 1

Related Questions