[Xitami] Denial of Service Attacks?

[Paul Reid]

> exactly what a Denial of Service attack is and how I can determine
> if someone has is trying to send one to my Xitami server?

Pretend that I hate you or your website.

So much, that I come over to your place with a big axe and cut your
wire, maybe axe your machine to pieces.

That's a Denial of Service (DoS) attack. I have Denied you and/or
your clients the Service that you were providing.

Of course axing-up a PC is hard work. And I don't know where you
are. And you might have a 100 pound dog sleeping in your computer
room.

So I let my computer do my dirty work.

One way is to find a back door on your machine, where I can slip in
and delete files or install my own malicious program to corrupt or
wipe your machine.

Another way to make your web service unavailable, without knowing
any backdoor on your machine, would be to run a program on my
machine that *constantly* requested pages or files from your
machine. If I do enough of that, all other users will have a very
hard time using your service.

But if I'm on dial-up modem, and you have Portal-Class servers and
connection to the network backbone, I can request all I can and you
may never even notice the silly "attack". And I've lost the use of
my own machine and connection while it is busy trying to over-load
your machine.

So hackers enlist other people's machines to help. Many Windows
machines have no passwords, and it is easy to install programs on
them. Windows often has unpatched loopholes. Also, many people will
open any darn thing they fine in their mailbox, so I send them my
malicious program and some of them will run it. If I can get 100
other machines to keep your machine busy, your machine has a very
high load and my machine isn't being used at all. And the attack
does not trace back to me.

Variations of these tricks have thrown -thousands- of "innocent"
machines against the US White House server and GRC's site. Both were
able to dodge the attack, either in advance or by a long night of
hasty network configuration. But it wasn't any fun for them.

There seem to be an endless stream of new variants of DoS attacks.
If a DNS server can be hacked, all requests for one site may end up
at some other site. My school has been getting hit at the black-box
machine that connects us to the outside world.

So there isn't any single thing to look for, to show that you may be
under DoS attack. The best hacks leave no traces. Even if your
machine does stop working, it may not be easy to know if it was an
outside attack or something wrong in the machine.

 -PRR