Re: Nessus scan caused Apache to die

On Fri, 28 Jan 2005, Bart Verwilst wrote:

> To: nessus@list.nessus.org
> From: Bart Verwilst <Bart.Verwilst@hostbasket.com>
> Subject: Nessus scan caused Apache to die
>
> Hi,
>
> I ran a nessus scan on a subnet, and noticed that an apache went down...
> While reviewing the logs, it seemed that nessus spammed the apache
> server with 1-2 requests per second for an hour.. It clearly was trying
> every vulnerability in the book.. I had the 'not-dangerous' option on,
> but it wasn't the actual tests, but the sheer quantity that brought it
> down.. Any ideas on how I can stop this from happening the next time?
> Thanks in advance!
>
> Bart Verwilst

Apache under Linux should be able to handle alot more
requests than that per second, without crashing or dieing.

It may be that your resources are set too low in httpd.conf.

Also, Take alook in the Apache documentation at
manual/misc/perf-tuning.html.

This applies to the 1.3.x series under Linux.

AFAIK, the windows 1.3.x version is not as robust as the
Linux 1.3.x version.

> From the 1.3 Linux documentation:

-- quote --

Note that this is tailored towards Apache 1.3 on Unix. Some
of it applies to Apache on NT. Apache on NT has not been
tuned for performance yet; in fact it probably performs very
poorly because NT performance requires a different
programming model.

-- unquote --

HTH

Kind Regards - Keith Roberts





_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus