[woahxx]

Hi, I decided to make up a quick HTTP Flood Mitigation Script.

Acces Denied Page.
Spoiler (Click to View)

Code

<html>
<h1>Acces denied</h1>
<br>
<hr>
<br>
<h4>We noticed that you're sending too many connection to our server.</h4>
</html>

---

Anti Flood Script:
Spoiler (Click to View)

Code

<?php
// Legit visitors
if (!isset($_SESSION)) {
        session_start();
}
// anti flood protection
// blocks visitors that entered page earlier than 2 seconds ago
if($_SESSION['last_session_request'] > time() - 2){
      
// Where to send the attacker.
        header("location: http://example.com/ddos.php");
        exit;
}
$_SESSION['last_session_request'] = time();
?>

[Idle cares]

Flooding is a type of denial of service attack. Meaning all the server's available processing power/ram/network bandwidth (which ever fails first) is allocated to spam traffic.

Programs that are intended to do this kind of attack will not store session cookies, nor will they follow your redirect.

Kinda useless, sorry.

[woahxx]

Flooding is a type of denial of service attack. Meaning all the server's available processing power/ram/network bandwidth (which ever fails first) is allocated to spam traffic.

Programs that are intended to do this kind of attack will not store session cookies, nor will they follow your redirect.

Kinda useless, sorry.

It would work with .exe programs like Anonymous DDoSer used by skids.

[Angel Beats‌‌]

It would work with .exe programs like Anonymous DDoSer used by skids.

No. It wouldn't work. Not at all. All it will do is stop people holding f5 down

[brentx97]

Hey hey, I Think you should just develop ur script more take these guys their "feedback" & do what u wanted to :P

---

http://stackoverflow.com/questions/12553...dos-in-php seems pretty much the same :p

[Chickendipper]

This wouldn't help the server too much - the PHP code would still be executed, and in turn, resources used up.
It's a nice idea, but poorly executed.

Maybe move to a database approach? Log IPs and if the IP is trying to spam (ie 10 requests to the same page in less than 10 seconds), block their access for 30 seconds or so. (Use something like die("Bad boy!"); so the script execution stops and only "Bad boy!" is sent)

[Stefvdwel]

I started like this too :p
I once made something like this but with sleep().
Everytime the time between request was shorter than 1/2 seconds, the sleep would last 1 second longer.
So the first time the sleep was set on 1. The second time it was set on 2. The third time it was set to 3 and so on.

As said, this doesn't work. But it's a nice concept ;)