What is all this?

Discussion in 'Site & Server Administration' started by stmiki, Sep 13, 2008.

0
  1. #1
    I hit up a netstat command out of curiosity and noticed this.

    [​IMG]

    Can anyone elaborate on what exactly that might be?

    The IP's originate from Korea/China
     
    stmiki, Sep 13, 2008 IP
  2. nimhost

    nimhost Active Member

    Messages:
    235
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    58
    #2
    seem a ddos attack to your server :)

    ask the support to monitoring any connection to your server
    your ds provider support was very good because i'm using same ds provider with you :)
     
    nimhost, Sep 14, 2008 IP
  3. jliu

    jliu Peon

    Messages:
    235
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #3
    It could be a DDOS attack but your screen doesn't show all the connections. How's your server load? You should see how many connections are being made to determine if it indeed is an attack:

    netstat -n | grep :80 |wc -l

    netstat -n | grep :80 | grep SYN |wc -l
     
    jliu, Sep 14, 2008 IP
  4. stmiki

    stmiki Peon

    Messages:
    523
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Server load was 0 0 0

    After some research it looks like just a web crawler bot called "Baidu" or something
     
    stmiki, Sep 16, 2008 IP