<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>I would run something every minute into a file with some time stamps to count the number of connections coming from the same IP hoping that if it is a DoS attack its not distributed from several sources.</div><div><br></div><div>Try something like,</div><div> Netstat -nut | awk '{print $5}'| cut -d: -f1|sort|uniq -c</div><div><br></div><div>Hopefully that gives you a clue of the concentration of connections when it starts going pear shaped. The problem is that when it happens the box may have its process table so full it can't fork any more connections and the script won't run.<br><br><div><br></div></div><div><br>On 5 Nov 2012, at 20:14, Lee Evans <<a href="mailto:lee@leeevans.org">lee@leeevans.org</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:black;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><div class="WordSection1"><p class="MsoNormal"><span style="font-size:10.0pt;color:black">Hi all,<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">We have a client with a linux web server (apache, mysql, php) running some wordpress sites.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">They are a relatively high volume site.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">We have been having some trouble with outages, which I suspect to be due to load (and possibly malicious at that) issues.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">The server locks up or grinds to a halt, there are far more httpd processes running than normal yet the usage stats suggest that there aren’t many live users.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">My personal suspicion given the symptoms is a targeted DDoS attack using some sort of SYN flood to open too many connections which have a dead end.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">Is there anyone out there that would be interested in helping us get to the bottom of this?<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">It’s beyond our skill set with general server / apache installation and maintenance.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">Thanks<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black">Lee<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;color:black"><o:p> </o:p></span></p><p class="MsoNormal"><o:p> </o:p></p></div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Wylug-discuss mailing list</span><br><span><a href="mailto:Wylug-discuss@wylug.org.uk">Wylug-discuss@wylug.org.uk</a></span><br><span><a href="https://mailman.lug.org.uk/mailman/listinfo/wylug-discuss">https://mailman.lug.org.uk/mailman/listinfo/wylug-discuss</a></span><br></div></blockquote></body></html>