Troubleshooting an SSL flood

Question

Users connect to our webserver via https, and stay on a secured connection throughout their use of our service. A typical user session will establish a small handful of connections to the server (one or two).

There are a very small number of exceptions we are trying to track down. Particular users will intermittently have handfuls of hundreds of connections established. When we happen to catch the problem in the act, we can see the exchange of the SSL handshake, and from the perspective of the server, all appears to be in order. Yet we never observe a payload - the client instead connects on a new port and initiates a new handshake.

We do not have access to the client, and cannot observe the behavior from that side of the connection. Nor do we have a local scenario that can reproduce the problem.

It is our belief (though not confirmed) that the user agent is connecting to our server directly, and not through a proxy.

Does anybody recognize these symptoms? Can anyone suggest steps to further identify the problem?

Answer 1

Are there any patterns you can see to this traffic, aside from making many repeated requests?

For example, do the requests come from the same IP ranges? Possibly search engines or other spiders, or maybe from countries that you normally don't get users from, possibly indicating some sort of weird botnet or at least something you could block?

Do these rogue requests always negotiate to use a particular cipher suite, potentially indicating the client software?
Does it make any difference if you change the available cipher suites available for negotiation?

What server software are you using, and are there any firewalls within your network that could potentially be dropping some responses to the user?