网站会自行从拒绝服务攻击中恢复吗?
我现在的处境相当特殊。长话短说,我是一个(现实生活中)志愿者组织的成员,该组织约有 2000 名成员。我们当前的网站是由不再是该组织的成员(他退出)建立和维护的。不幸的是,他是唯一真正有权访问服务器的人,并且在他离开后并没有配合将控制权移交给其他人。因此,我和一小群人一直致力于从头开始为我们自己创建一个新网站。原始网站上的数据对于新网站来说会很棒,因此在无法直接访问数据库的情况下,我们一直在屏幕上抓取我们需要的内容。
这让我想到了我目前的难题。我使用的屏幕抓取脚本非常慢,所以我有了并行化它的绝妙(不是)想法。我认为瓶颈是由我的网速慢引起的,所以我愚蠢地决定一次运行 250 个线程。在我尝试之后,Web 服务器神秘地宕机了,此后就再没有恢复过(现在已经过去了大约 30 分钟)。
我不是任何类型的黑客或安全专家,但我很确定我只是不小心对服务器造成了拒绝服务攻击。这让我想到了我的问题 - 假设网站所有者没有采取任何措施来帮助我们,服务器会自行恢复吗? (如果重要的话,它由 Linode 上的 Django 托管)。网站通常如何从 DoS 攻击中恢复?我是否可能误诊了正在发生的事情,是否有其他解释?或者网站永远丢失了?
编辑:所有 250 个请求都是简单的 http 请求,将发送到 Django 管理面板中的页面(如果这会改变任何内容)。
I'm in a rather peculiar situation right now. To make a long story short, I'm part of a (real life) volunteer organization of about 2000 members. Our current website was built and maintained by a member who is no longer part of the organization (he quit). Unfortunately, he was the only one that actually had access to the server, and hasn't been cooperative in handing over the reigns to someone else after he left. As a result, myself and a small team of people have been working on creating a new website for ourselves from scratch. The data on the original website would be awesome to have for the new one, so without direct access to the database we have been screen-scraping what we need.
Which brings me to my current conundrum. The screen-scraping script I was using was being really slow, so I had the brilliant (not) idea of parallelizing it. I assumed the bottleneck was caused by my slow internet, so I foolishly decided to run 250 threads at once. After I tried that, the web server mysteriously went down and hasn't gone up since (it's been about 30 minutes now).
I'm not any kind of hacker or security expert, but I'm pretty sure I just accidentally caused a Denial of Service attack on the server. Which brings me to my question - assuming the owner of the website does nothing to help us, will the server come back to life of its own accord? (it's being hosted by Django on Linode if that matters). How do websites typically recover from DoS attacks? Have I potentially misdiagnosed what's going on, and could there be an alternative explanation? Or is the website lost forever?
Edit: All 250 of the requests were simple http requests going to pages within the Django admin panel if that changes anything.
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
系统很可能不会真正永久关闭,除非该人可能生气了或者托管提供商等由于流量负载而禁用了它。但有很多事情需要考虑。但 250 个连接并不是那么大的负载,即使对于共享主机帐户也是如此,除非您只是向服务器发送大量请求。
根据所使用的技术,有许多事情“可能”发生。
在不知道托管提供商或环境的情况下,这些只是猜测。
我强烈建议您关闭您的刮刀!
More than likely the system is not truly down for good, unless the guy might have gotten pissed or the hosting provider, etc disabled it due to the traffic load. But there are a number of things to think of. But 250 connections isn't that much load, even for a shared hosting account, unless you were just flooding the server with requests.
Depending on what technology is used, there are a number of things that "could" have happened.
WIthout knowing the hosting provider or environment these are just guesses.
I would strongly recommend though turning off your scraper!
如果还没有的话,您应该停止屏幕抓取软件。
根据系统的哪个部分发生故障(数据库、服务器、网络或全部),当负载恢复时,它有可能自行恢复。
如果您的应用程序无法维持 250 个并发连接,您将需要调查原因。罪魁祸首通常是数据库负载(没有索引、未优化的查询)。
Linode 还可以设置限制,以限制在特定时间段内可以使用多少带宽。您可能应该联系他们(或负责人)。
You should stop your screen-scraping software if you have not already.
Depending on what part of the system is down (Either the database, the server, the network or all), there is a chance it will recover by itself when the loads come back down.
If your application cannot sustain 250 simultaneous connections, you will want to investigate why. The culprit is usually database load (no indexes, un-optimized queries).
Linode could also have restrictions in place to limit how much bandwidth can be used within a certain period of time. You should probably contact them (or whoever is in charge).