Heya guys, So im having abit of a problem, someone bringing down my apache all the time by flooding apache? This is how the logs look like from apache logs CPU Usage: u287.03 s11.86 cu0 cs0 - 46.3% CPU load 107 requests/sec - 0.6 MB/second - 5.9 kB/request 600 requests currently being processed, 0 idle workers 341-0 22401 0/3/480 W 0.03 451 0 0.0 0.03 2.71 172.205.92.241 domain.com GET / HTTP/1.1 342-0 22402 0/6/437 W 0.04 471 0 0.0 0.04 2.97 172.205.92.241 domain.com GET / HTTP/1.1 343-0 20251 0/215/299 W 2.02 491 0 0.0 1.63 2.17 172.205.92.241 domain.com GET / HTTP/1.1 344-0 21706 0/184/889 W 1.87 448 0 0.0 1.42 5.32 172.205.92.241 domain.com GET / HTTP/1.1 345-0 - 0/0/844 . 0.68 95 0 0.0 0.00 4.75 127.0.0.1 home.domain.com OPTIONS * HTTP/1.0 346-0 21084 0/186/949 W 1.86 450 0 0.0 1.56 6.60 172.205.92.241 domain.com GET / HTTP/1.1 347-0 22404 0/0/1122 W 1.83 488 0 0.0 0.00 5.95 172.205.92.241 domain.com GET / HTTP/1.1 348-0 21708 0/193/1225 W 1.93 459 0 0.0 1.23 7.51 172.205.92.241 domain.com GET / HTTP/1.1 349-0 22405 0/8/454 W 0.09 453 0 0.0 0.03 1.85 172.205.92.241 domain.com GET / HTTP/1.1 350-0 22406 0/20/579 W 0.21 451 0 0.0 0.05 3.82 172.205.92.241 domain.com GET / HTTP/1.1 351-0 22407 0/4/910 W 0.03 471 0 0.0 0.09 5.91 172.205.92.241 domain.com GET / HTTP/1.1 352-0 22410 0/0/943 W 4.42 488 0 0.0 0.00 6.02 172.205.92.241 domain.com GET / HTTP/1.1 Code (markup): What does this mean?
#netstat -ntu | grep SYN_RECV | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr if ip SYN_RECV > 20 #iptables -A INPUT -s ip -j DROP #netstat -ntu | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr if ip ESTABLISHED > 40 #iptables -A INPUT -s ip -j DROP or tell isp to block it credit deflate.medialayer.com and ems