Does Keepalive Off Help In Syn Flood
May 29, 2008Does keepalive off help in syn flood?
View 6 Replies
ADVERTISEMENT
Apache KeepAlive Setings
May 6, 2008I've been dealing with some problems in the last months, first problem was about the Mysql CPU usage, was realy high. After I have optimized alittle some tables I have resolved this issue. The server runs smoth with a single exception, when I get lots of RRRRRRRRRRRRRRR requests in apache status, basicaly the RRRR uses all the 200 apache conections.
Also I think my main website is not loading as fast as it should. (open homepage)
Now I was searching on optimizing the server and I see the KeepAlive is off.
My main website (2500 unique visitors/day) homepage has 123 elements in it (images, css and js files) and teoreticaly the keepalive set ON (timeout 2 seconds) it should help .
I'm wright ?
WHM APACHE STATUS PAGE
Current Time: Tuesday, 06-May-2008 12:03:54 EDT
Restart Time: Tuesday, 06-May-2008 07:35:25 EDT
Parent Server Generation: 7
Server uptime: 4 hours 28 minutes 29 seconds
Total accesses: 304742 - Total Traffic: 1.9 GB
CPU Usage: u3966.41 s338.39 cu.24 cs.26 - 26.7% CPU load
18.9 requests/sec - 124.1 kB/second - 6.6 kB/request
14 requests currently being processed, 45 idle servers
-----------------------------------------
WHM Service Status
Server Load1.68 (4 cpus)
Memory Used47.1 %
Swap Used3.82 %
-----------------------------------------
top - 12:13:44 up 34 days, 6:14, 1 user, load average: 0.90, 1.10, 1.03
Tasks: 149 total, 1 running, 148 sleeping, 0 stopped, 0 zombie
Cpu(s): 27.3% us, 2.2% sy, 0.0% ni, 67.1% id, 1.9% wa, 1.6% hi, 0.0% si
Mem: 2074364k total, 2034496k used, 39868k free, 116304k buffers
Swap: 2096440k total, 79900k used, 2016540k free, 972628k cached
PID USER PR NI %CPU TIME+ %MEM VIRT RES SHR S COMMAND
21927 nobody 15 0 15 0:02.16 0.8 34664 16m 3244 S httpd
29446 mysql 15 0 15 30:10.05 7.2 300m 144m 3808 S mysqld
29576 nobody 16 0 12 4:55.15 1.0 38728 21m 4340 S httpd
29578 nobody 15 0 9 5:38.88 1.0 37884 20m 4688 S httpd
29588 nobody 15 0 8 6:54.26 1.2 42768 24m 4708 S httpd
21892 nobody 15 0 8 0:04.47 0.8 34184 16m 3988 S httpd
21889 nobody 15 0 6 0:03.52 0.8 33960 16m 3888 S httpd
22003 nobody 15 0 6 0:00.44 0.8 31288 15m 3112 S httpd
21823 nobody 16 0 5 0:07.37 0.9 36884 18m 3360 S httpd
21910 nobody 15 0 4 0:03.68 0.9 35512 17m 3904 S httpd
21922 nobody 15 0 4 0:02.28 0.8 33816 15m 3264 S httpd
21888 nobody 15 0 4 0:02.70 0.8 33916 15m 3244 S httpd
21901 nobody 15 0 3 0:03.47 0.8 33840 15m 3284 S httpd
29574 nobody 15 0 3 6:41.31 1.2 42864 24m 4728 S httpd
21899 nobody 15 0 3 0:03.88 0.8 33912 15m 3364 S httpd
22002 nobody 15 0 3 0:00.34 0.8 33732 15m 3196 S httpd
29575 nobody 16 0 3 4:50.70 1.1 39912 22m 5184 S httpd
21890 nobody 15 0 2 0:04.45 0.8 34132 16m 4028 S httpd
21495 nobody 16 0 1 0:13.57 0.8 34732 17m 4060 S httpd
22011 admin 16 0 1 0:00.02 0.1 2132 1044 780 R top
477 root 15 0 0 14:30.45 0.0 0 0 0 S kjournald
21993 nobody 15 0 0 0:00.97 0.9 36244 17m 5064 S httpd
29875 root 16 0 0 1:26.26 0.2 6444 5032 2712 S authProg
1 root 16 0 0 2:34.74 0.0 2028 464 436 S init
2 root RT 0 0 0:41.75 0.0 0 0 0 S migration/0
3 root 34 19 0 0:02.41 0.0 0 0 0 S ksoftirqd/0
4 root RT 0 0 3:14.35 0.0 0 0 0 S migration/1
5 root 34 19 0 0:02.76 0.0 0 0 0 S ksoftirqd/1
6 root RT 0 0 7:31.58 0.0 0 0 0 S migration/2
7 root 34 19 0 0:04.85 0.0 0 0 0 S ksoftirqd/2
8 root RT 0 0 1:57.35 0.0 0 0 0 S migration/3
9 root 34 19 0 0:01.93 0.0 0 0 0 S ksoftirqd/3
Lots Of Keepalive Requests In Apache
Mar 31, 2008I have been experiencing a lot of Keepalive requests for a particular image on a particular domain. please see the lines below.
0-11233931/63/63K 0.15100.40.030.03 195.68.185.13mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
1-11233941/77/77K 0.18100.40.050.05 122.164.58.63mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
2-11233951/42/42K 0.76000.40.170.17 89.139.214.74mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
3-11233971/57/57K 0.04000.40.020.02 82.199.98.229mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
4-11233981/46/46K 0.27000.40.040.04 217.150.55.41mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
These are just a few lines from the top.
How can i prevent this from happening.. it seems as a SYN Flood, or maybe a DDoS.
How To Turn Off Keepalive Setting In Httpd.conf Didn't Work..
Jul 1, 2009So why does it still say Connection: Keep-Alive? I know that if its off, it should say Connection: Closed. And where did the timeout=1 and max=100 come from?
My httpd.conf
Timeout 90
KeepAlive Off
KeepAliveTimeout 15
KeepAliveRequests 10
HTTP headers is reporting
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Syn Flood
May 11, 2009I've been getting a syn flood for the last week or so.
I've pretty much tried everything I could online but have been unsuccessful in stopping them.
I talked to the data center techs and they basically can't put a stop to it either.
Here's a very small portion of my netstat
tcp 0 0 xxx.xxx.xxx.xxx:80 86.50.121.144:8540 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 41.100.16.152:7824 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 52.53.22.7:3146 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 77.217.49.124:1659 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 75.162.93.151:3230 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 113.85.63.249:1656 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 15.253.35.29:8849 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 24.56.59.180:6911 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 33.185.99.83:1917 SYN_RECV -
tcp 0 0 xxx.xxx.xxx.xxx:80 103.5.8.249:4782 SYN_RECV -
root@xxx [/]# netstat -nap |grep SYN |wc -l
2008
The IP's change often and it's not possible to narrow it down.
So far the things I have done;
syn cookies enabled
reduced time out
echo "1" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv
increased
echo "150000" > /proc/sys/net/ipv4/ip_conntrack_max
installed apf but it slowed down the server to a crawl which made my clients really unhappy so had to remove it.
The bandwidth is constantly staying at 30Mbps with slight bumps here and there but every day around 7pm it drops completely to normal levels and the flood stops. It starts back up around 7 in the morning.
SYN Flood Attack
Jul 28, 2009We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.
Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.
Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)
SYN Flood Attack
May 3, 2009someone decided to attack my webserver and I can't figure out how to block it.
tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV
It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.
We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.
Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.
How Can I Best Work With A Syn Flood?
Jun 11, 2008How can I best work with a syn flood? I've tried the apf, deflate-ddos etc.... and don't work. Even tried litespeed etc but doesn't work against a 90mbps attack.
If I get a few servers, how would I have it setup to best defend?
Syn Flood Protection
Jul 25, 2008one of my server were hit by massive ddos syn atack. target was port 80-apache
i am running centos 5 in xen vps iptables were strong with syn filtering and limit
but...what can do?
Connection Flood
Mar 8, 2008I don't know it anymore. Tried everything. I can not reach my server properly. A lot of time time out.
netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
1 127.0.0.1
1 38.99.44.101
1 64.131.90.38
1 78.176.158.75
1 78.179.73.135
1 88.229.70.143
1 88.242.97.204
1 88.247.87.58
1 92.112.211.223
3 78.176.175.136
3 88.229.40.142
3 88.231.180.181
4 78.183.227.146
18 0.0.0.0
348
348 connections from an empty IP? i have tried syn cookies, let the firewall block all ports without results.
How To Prevent DNS Flood
May 28, 2008Can anyone share tips how to prevent DNS flood on a cPanel and Directadmin server platform on Centos?
View 7 Replies View RelatedHow To Detect Flood Ftp
May 4, 2008My server run after 10h sevices ftp is down (network error: connection timed out). may be flood ftp.
how to Detect flood ftp.
UDP Flood And Bandwidth
Apr 4, 2008We got hit with a huge bandwidth bill for last month. It was 4X our usual bill. The ISP said that we were the victim of UDP flood attacks from an outside server. We have a sonicwall router and the firewall seems to be blocking the port that the ISP claims the attacks can from. Is it possible that the attacks would still count towards our bandwidth usage even if the connection is refused by our firewall? Our ISP uses 95th percentile billing.
View 6 Replies View RelatedSYN Flood .. No Way To Stop It ?
Oct 30, 2007One of the servers have 1 account on, but seems like its extremely attacked. I cannot SSH and many packet loss. so I asked softlayer and they access it and said its a SYN Flood as from the /var/log/messages (I cannot see it as the server is not accessable) they put the main public ip under Cisco guard but still didn't help. when I asked for any solution, unfortunaly I were told there isn't and have to wait the attackers to stop as it comes from MANY addresses that iptables even won't help.
Isn't there any solution (software-hardware) to stop that ?
Ddos Attacks / Udp Flood
Jun 25, 2008one of my costumers server is getting ddos attacks. I solved syn and get attacks with litespeed web server but I have another problem. They started to do udp flood. I m losing connection to my server. I bought new server with 1 gbit port for solving it.
View 3 Replies View RelatedFlood In FTP And Brute Force
Oct 27, 2008flood in FTP and brute force
all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:
/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....
Robots Flood My Server
Jul 26, 2009I use Outpost Firewall to view active connections to my server. If I don't restart the httpd service on a regular basis my server will grind to a halt from being flooded by robots.
I currently have the service set up to restart at Midnight and Noon every day. Sometimes that's enough, lately it's not. For example, I checked an hour ago and I had 385 connections to httpd. At least 50% of the connections were robots - tons of the same IP addresses and they're just crawling the site.
Almost all of the connections show up as less than 1kb bytes received and 0 bytes sent per connection.
I already have a good 20 connections by these robots and the connection time shows as 11 minutes... I just browsed to a web gallery page on my site figuring that'd be mildly "intensive" on connections with all the thumbnails and my connections aren't lasting more than one minute.
So, what's with all these connections that are lasting 10+ minutes? I've even got one connection that has an Uptime of 30 minutes, bytes sent 65811, bytes received 180. It seems like something with these robots doesn't terminate correctly...
what to do so these connections quit jamming my server up? It's like a very very slow DOS...
Flood Connections On Port 80
Aug 1, 2007When I check on port 80 connections, I get a list of few IPs with more than 100 connections.
I need to know which website / specific file being downloaded / URL is the IP accessing to? How can I do that?
Inbound SYN Flood Attack
Jan 11, 2007my server under attack with syn flood and i attach the active connection during attack
View 2 Replies View RelatedHow To Secure Your Web From FLOOD ; Ddos ; Etc
Jun 20, 2007some of my friend website is under attack by Ddos ; FLOOD ; and other way to down his site !
how can we save him from these attacks?
else the firewall!
1- is there any program or script to prevent these attacks!
2- is there any rules or script's for Firewall to prevent it!
Apache :: Flood Of 302s After Redirect
Jun 5, 2015I serve large professional documents, and sometimes links to them end up on social media. No big deal, but I think people clicking on them from tose social media sites don't have a clue. They think they're being directed to small page, when in fact they are downloading megabytes of pdf -- myfile.pdf. So what I've started to do is to redirect requests from social media to an archive page, where they can see specifically what document they are trying to get, and recognize its size before they ask for it. No problem, right? I just do
View 10 Replies View Related