Date: Thu, 22 Apr 2004 08:21:38 +0800 From: "meimi" <meimi_1@hotmail.com> To: "Tuc" <tuc@ttsg.com> Cc: freebsd-questions@freebsd.org Subject: Re: being DOSed Message-ID: <BAY16-DAV52mvmsckqR0000625c@hotmail.com> References: <200404212329.i3LNTYfM026056@himinbjorg.tucs-beachin-obx-house.com>
next in thread | previous in thread | raw e-mail | index | archive | help
I have found some IPs are opening 10 HTTP connection. Their IPs are changing and all IPs are from different ISP network. What should I do next? Thanks Meimi ----- Original Message ----- From: "Tuc" <tuc@ttsg.com> To: "meimi" <meimi_1@hotmail.com> Sent: Thursday, April 22, 2004 7:29 AM Subject: Re: being DOSed > > > > Hello, > > The bandwidth usage for my server is tripled for 3 hours. When I run > > "top", I find many httpd process in sbwait status. So, I think someone is > > DOSing my server. > > How can I check who is DOSing me? and how can I solve it? > > Thanks > > Meimi > > Quickly : > > netstat -an | sort | grep tcp4|more > > Look for an IP with alot of connections. (We have a script that > actually will count this for us, but its not just for FreeBSD so its > long) > > Tuc/TTSG Internet Services, Inc. >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BAY16-DAV52mvmsckqR0000625c>