HIDS 60205
Rule ID
60205
Status
Active rule currently published.
Message Example'
hostname mod_evasive[12345]: Blacklisting address 1.2.3.4: possible DoS attack.
Description
This rule detects when the mod_evasive module is triggered. mod_evasive is a Denial Of Service detection module for apache, it detects when an IP address exceeds a connection threshold (Example: X connections in Y seconds, or X accesses for the same page from a single IP in Y seconds).
False Positives
This rule can be falsely triggered if the configured thresholds for the system have been exceeded.
If you believe that this is a false positive, then either disable the DOS protections in ASL, increase the thresholds or whitelist the IP. The section below provides a link to the process for doing this.
Solutions
Please see the Mod_evasive wiki page for detailed guidance.
Solution 1: Increase the thresholds for mod_evasive to be less sensitive
Solution 3: Disable mod_evasive
Similar Rules
None.
