The first method is external load/stress testing – great solution for commercial projects. But there is also another good way for Apache – it’s open-source and free, called ApacheBench. It’s incredibly easy to use:

#ab -c10 -n3000 http://www.fastmonitoring.com/

• ab the name of the program
• C10 means the number of threads
• n3000 is the number of requests.

The program has a great variety of additional parameters — just check the official documentation. You can use cookies, POST requests, modified headers — everything that will help to simulate server users activity.

The program output is quite comprehensive:

Document Path:          /
Document Length:        121779 bytes
Concurrency Level:      10
Time taken for tests:   211.255212 seconds
Complete requests:      3000
Failed requests:        0
Write errors:           0
Total transferred:      63177000 bytes
HTML transferred:       63171000 bytes
Requests per second:    10.41 [#/sec] (mean)
Time per request:       480.425 [ms] (mean)
Time per request:       96.085 [ms] (mean, across all concurrent requests)
Transfer rate:          226.23 [Kbytes/sec] received
Connection Times (ms)
min  mean[+/-sd] median   max
Connect:        0    0   0.5      0      19
Processing:   181  479 186.0    444    1822
Waiting:      166  461 184.7    427    1708
Total:        181  479 186.0    444    1822
Percentage of the requests served within a certain time (ms)
50%    444
66%    525
75%    577
80%    619
90%    732
95%    819
98%    946
99%   1012
100%   1822 (longest request)

Highly recommended.

The first threat is virus attacks. Virus infection may lead to disastrous consequences: data leakage, destruction of all the information, server software destruction or just server blocking caused by inability to process all the incoming requests. On the most famous example of the latter case was root DNS servers attack in October, 2002. This attack resulted in freezing of 7 root servers (there were 13 overall), and all the Internet operation got under the threat of stopping. The attack was performed by data flood: 13 servers containing information about top-level domains (.com, .org, etc.) were flooded with ICMP packets. When the attack was over, experts said that if it had continued for more than 10 hours, the Internet users would have seen significant Internet slowdown and then even suspension of work.

Why the root DNS attack may have such serious consequences? The reason is the hierarchical structure of DNS servers. The first request goes to the local server. If the requested domain name cannot be found, the request goes further, to a higher-level server. Requests usually reach the root servers when new domain names appear on the Net. Furthermore, every record on DNS servers has a limited time to live (TTL), and when a record has expired, the server sends a request to a DNS server of a higher level. Since new domain names are added daily, the information on lower-level servers gets outdated. This explains why if root servers are disabled, Internet will work for a while but then will stop.

The second threat is false DNS servers. This phenomenon has been developed by malefactors. The malefactors may pursue different objects, the gist is always the same: to make a real server work in a wrong way or block it. The victims of such attacks are DNS servers as well as end users. If a malefactor succeeds in providing a host with counterfeit DNS information, the host will send data to a counterfeit IP address. At the best the end user won’t be able to surf Internet or use Internet services. At worst, the confidential data from the host may be sent to a malefactor’s server.

How can one protect DNS servers from remote attacks? Of course, absolute protection does not exist, but possible effect may be diminished. Of of the options is implementation of authentication and integrity of the information kept in DNS. To solve this problem on Internet the DNS system has been extended (extensions are called DNSSEC and are described in RFC-2535, RFC-2536, RFC-2537, RFC-2541, and RFC-3008). The main idea of DNSSEC is applying a digital signature to transferred data. To develop this concept, IETF created DNSSEC Working Group. Using DNSSEC doesn’t require a private key from the recipient, and this allows walking round the unsolvable problem of distribution of the private key among all the existing DNS servers on the Internet. It also helps to get rid of the problem of providing secure DNS traffic. However there is a price for the security – significant increase of the database for every zone and enhanced requirements for server CPU, which is required to perform encryption/decryption operations.

Another alternative is using special hardware and software. They include:

• Network traffic cipherer
• Hardware and software firewalls
• Secure network crypto-protocols
• IDS – Intrusion Detection Systems
• Software for security analysis
• Secure network OS

Whatever method or combination of methods a network administrator chooses, it is extremely important to monitor DNS servers for uptime and security holes. One of the easiest ways to be aware of a DNS server is hosted DNS monitoring service, which is offered by some commercial companies.

___

it support

dana point web design – Xtgate is devoted to creating web sites and an online existence that is matching with the brand of our customers and expresses the brand name clear and distinct, stanch to its brand unicity and certain about it is tone of voice.

iphone application development

• Gtrace is a traceroute visualization tool that uses a combination of methods
  to either determine or guess at the physical location of a node in
  the traceroute path. It is flexible enough to support addition of new
  databases, heuristics to map IP addresses to physical location and maps.
• mturoute is a small Windows tool to determine the path MTU between you and a specified host.In traceroute mode it will additionally show you the mtu at every hop between you and the specified host.
• NeoTrace provides graphical traceroute information.
• Prtraceroute is a version of traceroute, from the RIPE
• Internet Routing Registry toolset, that presents routing policy information together
  with the real time packet trace obtained from traceroute. It adds AS information to the
  normal traceroute output, making use of Routing Registry (RR) database information.
• Scamper is a program that conducts traceroute to large numbers of IPv4 and IPv6 addresses in parallel to fill a specified packets-per-second rate.
• TCPtraceroute uses TCP to a port at the end node to do a traceroute.
• Traceroute-nanog has additional features like AS lookup, TOS support,
  microsecond timestamps, path MTU discovery, parallel probing and others.
• VisualRoute a GUI based traceroute for Windows.