<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:10.0pt;color:black'>Thanks Paul that’s a nice command and a good idea – I’ll do just that and see where we get to.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>Thanks<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>lee<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB'> Paul Branston [mailto:apbran@rannoch.demon.co.uk] <br><b>Sent:</b> 06 November 2012 07:03<br><b>To:</b> Lee Evans<br><b>Cc:</b> <wylug-discuss@wylug.org.uk><br><b>Subject:</b> Re: [Wylug-discuss] Linux server assistance<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>I would run something every minute into a file with some time stamps to count the number of connections coming from the same IP hoping that if it is a DoS attack its not distributed from several sources.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Try something like,<o:p></o:p></p></div><div><p class=MsoNormal> Netstat -nut | awk '{print $5}'| cut -d: -f1|sort|uniq -c<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Hopefully that gives you a clue of the concentration of connections when it starts going pear shaped. The problem is that when it happens the box may have its process table so full it can't fork any more connections and the script won't run.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><br>On 5 Nov 2012, at 20:14, Lee Evans <<a href="mailto:lee@leeevans.org">lee@leeevans.org</a>> wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span style='font-size:10.0pt;color:black'>Hi all,</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>We have a client with a linux web server (apache, mysql, php) running some wordpress sites.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>They are a relatively high volume site.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>We have been having some trouble with outages, which I suspect to be due to load (and possibly malicious at that) issues.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>The server locks up or grinds to a halt, there are far more httpd processes running than normal yet the usage stats suggest that there aren’t many live users.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>My personal suspicion given the symptoms is a targeted DDoS attack using some sort of SYN flood to open too many connections which have a dead end.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>Is there anyone out there that would be interested in helping us get to the bottom of this?</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>It’s beyond our skill set with general server / apache installation and maintenance.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>Thanks</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'>Lee</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;color:black'> </span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p></div></blockquote><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:EN-GB'>_______________________________________________<br>Wylug-discuss mailing list<br><a href="mailto:Wylug-discuss@wylug.org.uk">Wylug-discuss@wylug.org.uk</a><br><a href="https://mailman.lug.org.uk/mailman/listinfo/wylug-discuss">https://mailman.lug.org.uk/mailman/listinfo/wylug-discuss</a><o:p></o:p></span></p></div></blockquote></div></body></html>