Server really playing up - will pay for someone to resolve!

Discussion in 'Apache' started by kes, Jan 31, 2009.

0
  1. #1
    have not got a lot to spend but i will pay someone to help out with an issue i have.

    Im on a webfusion VPS server and its currently got 5 sites on there.

    But the numtcpsock is maxing out every few mins which in turn is making the sites freeze up all day.

    Now, I have realtime visitor software on all the sites, so i can see how many people are on ALL sites.

    But even when theres only 2-3 people on, the numtcpsock is maxing out

    The numtcpsock is set to 166 (cannot be changed) surely this should not max out with only this amount of people on ?

    Could there be something else causing the numtcpsock to max out ?
     
    kes, Jan 31, 2009 IP
  2. sakeura

    sakeura Banned

    Messages:
    241
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Ok check you inbox i will see
     
    sakeura, Jan 31, 2009 IP
  3. kes

    kes Active Member

    Messages:
    368
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #3
    kes, Jan 31, 2009 IP
  4. Linked2K

    Linked2K Peon

    Messages:
    19
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    run this command as root:

    iptables -I INPUT -s 114.236.61.253 -j DROP

    This will drop any packets coming from given source. This should cure it. Unless they change ip.
     
    Linked2K, Jan 31, 2009 IP
  5. kes

    kes Active Member

    Messages:
    368
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #5
    Its not just one ip that has several connections, it seems to happen alot with different ip's

    that will just be a quick fix for the one ip and not resolve the issue
     
    kes, Jan 31, 2009 IP
  6. kailash

    kailash Well-Known Member

    Messages:
    1,248
    Likes Received:
    42
    Best Answers:
    0
    Trophy Points:
    190
    #6
    Do you have any firewall installed on the server ? If not then I would suggest to install either CSF or APF.

    Kailash
     
    kailash, Jan 31, 2009 IP
  7. kes

    kes Active Member

    Messages:
    368
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    55
    #7
    yeah has both of the below..

    Cisco Firewall Protection
    Intrusion Prevention System
     
    kes, Jan 31, 2009 IP
  8. Linked2K

    Linked2K Peon

    Messages:
    19
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #8
    Ok. If it happens with many ip's it is probably done with a botnet. If the botnet is large there is not luch you can do. If it is quite small it would be easy to fix. I developed a script for my server which automatically bans an ip with too many connections. It works against moderately sized skiddie attacks. I can share it with you.
     
    Linked2K, Jan 31, 2009 IP
  9. joebert

    joebert Well-Known Member

    Messages:
    2,150
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    145
    #9
    Some browsers, for instance Opera, allow the user to set the number of connections the browser will attempt to make to the server at one time. From the browser point of view, this allows a browser to download the images, CSS, etc that makes up the page faster since there's X connections transfering files at one time instead of 1.

    I believe some browsers, for instance Internet Explorer, have their own non-configurable limit on connections.

    For example sake, I use Opera and the max number of connections my browser attempts to make to a single server is 8, which is Operas' default. That means that evey time I request a page from your server, as many as 8 connections will be made to either download new resources or check last-modified timestamps for others.

    I could easily set this limit to as high as 128 in Opera, meaning I by myself, could deplete the majority of your slots in one request if there were enough resources to download, I don't know the limit for Firefox off-hand, but I imagine it's similar.

    Now, if you've got KeepAlive turned on, those connections are going to sit around waiting for me to request something else over them for KeepAliveTimeout seconds, which by default I believe is 15 seconds.

    You could turn KeepAlive off to get rid of lingering connections all together, or, you can set KeepAliveTimeout to 1-2 seconds so Apache can attempt to reuse connections for the multiple small images your forum appears to have in the theme without holding on to them for too long.
     
    joebert, Feb 4, 2009 IP