Portal Home > Knowledgebase > Articles Database > DoS attack incidents or mail bombs on my server
DoS attack incidents or mail bombs on my server
| Posted by Ilan, 07-28-2012, 09:05 PM |
| I'm getting very high current load but i don't know what is causing that.
root@wolverine [~]# service httpd status
Apache Server Status for localhost
Server Version: Apache/2.2.22 (Unix) mod_ssl/2.2.22
OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.2.17
Server Built: Jul 26 2012 07:16:56
_________________________________________________________________
Current Time: Saturday, 28-Jul-2012 20:59:52 EDT
Restart Time: Saturday, 28-Jul-2012 08:53:33 EDT
Parent Server Generation: 6
Server uptime: 12 hours 6 minutes 19 seconds
Total accesses: 549027 - Total Traffic: 5.4 GB
CPU Usage: u258.51 s22.66 cu.33 cs0 - .646% CPU load
12.6 requests/sec - 130.9 kB/second - 10.4 kB/request
31 requests currently being processed, 11 idle workers
KK__WK.KWK_K_KKKK.W_KKWKKC_KK_WKK.._K_W_KC_C...........K.......K
................................................................
................................................................
................................................................
Scoreboard Key:
"_" Waiting for Connection, "S" Starting up, "R" Reading Request,
"W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
"C" Closing connection, "L" Logging, "G" Gracefully finishing,
"I" Idle cleanup of worker, "." Open slot with no current process
root@wolverine [~]#
any helps please
|
| Posted by Erawan Arif Nugroho, 07-28-2012, 09:29 PM |
| how about the netstat results?
|
| Posted by Ilan, 07-28-2012, 09:38 PM |
| the server has very high load
|
| Posted by suvro, 07-28-2012, 11:55 PM |
| post its output .
netstat -tulnap|grep 80
and try to track high process by top -Mc command .
|
| Posted by EthernetServers, 07-29-2012, 11:11 AM |
| Do you have a software firewall such as APF or CSF? If not, I would recommend installing one. My personal favourite is CSF. A software firewall doesn't stand a chance against large DDoS attacks, but if it's just DoS you're getting, a software firewall could make the difference.
To install CSF, go here: http://configserver.com/free/csf/install.txt
Once installed, make sure to configure it to your needs.
|
| Posted by Ilan, 07-30-2012, 02:17 AM |
| I have installed CSF firewall.
Which can be setup to stop attacks on the server?
|
| Posted by EthernetServers, 07-30-2012, 02:21 AM |
| Is this server hosting other sites that dont belong to you?
|
| Posted by Ilan, 07-30-2012, 02:38 AM |
| Yes, this server hosting other sites the clients
|
| Posted by TravisT-[SSS], 07-30-2012, 01:21 PM |
| Apache does not look like it is under an attack. Can we get a netstat and top view?
|
Add to Favourites 
Print this Article
Also Read
Possible? (Views: 568)