Assistance with preventing server load spikes on VPS's

xman888

Well-Known Member
Nov 23, 2005
61
1
158
Hello,

I am wondering if there are some people that can help me to try and prevent server load spikes on my VPS's.

Generally server load on all my VPS's is fine, however every hour, or couple of hours, it tends to spike.

The spike may be 10, however can sometimes be alot higher. At these times, WHM takes a really long time to open, and my client sites do as well.

I have collected as much output that I could from one of my VPS's, so that, if possible, I can get some suggestions from the community as to how to tweak my VPS, and then once working, do it to all VPS's.

I have posted the output below.

Any help would be greatly apprecaited.

Kind regards,
Anthony

Note: the server load when the below was taken was fine.

./mysqlmymonlite.sh mysqltuner
Code:
[OK] Logged in using credentials passed on the command line
[--] Assuming 3072 MB of physical memory
[--] Assuming 3072 MB of swap space
-------- General Statistics --------------------------------------------------
[--] Skipped version check for MySQLTuner script
[OK] Currently running supported MySQL version 5.1.65-cll
-------- Storage Engine Statistics -------------------------------------------
[--] Status: +Archive -BDB -Federated +InnoDB -ISAM -NDBCluster
[--] Data in MyISAM tables: 36M (Tables: 108)
[--] Data in InnoDB tables: 208K (Tables: 13)
[!!] Total fragmented tables: 4
-------- Security Recommendations  -------------------------------------------
[OK] All database users have passwords assigned
-------- Performance Metrics -------------------------------------------------
[--] Up for: 5d 22h 36m 56s (16M q [31.796 qps], 240K conn, TX: 145B, RX: 2B)
[--] Reads / Writes: 76% / 24%
[--] Total buffers: 306.0M global + 2.7M per thread (100 max threads)
[OK] Maximum possible memory usage: 574.7M (18% of installed RAM)
[OK] Slow queries: 0% (104/16M)
[!!] Highest connection usage: 100%  (101/100)
[OK] Key buffer size / total MyISAM indexes: 8.0M/6.9M
[OK] Key buffer hit rate: 100.0% (15M cached / 1K reads)
[OK] Query cache efficiency: 91.7% (13M cached / 14M selects)
[!!] Query cache prunes per day: 3716
[OK] Sorts requiring temporary tables: 0% (0 temp sorts / 207K sorts)
[!!] Temporary tables created on disk: 48% (175K on disk / 359K total)
[OK] Thread cache hit rate: 99% (101 created / 240K connections)
[OK] Table cache hit rate: 93% (344 open / 367 opened)
[OK] Open file limit used: 1% (462/43K)
[OK] Table locks acquired immediately: 99% (1M immediate / 1M locks)
[OK] InnoDB data size / buffer pool: 208.0K/8.0M
-------- Recommendations -----------------------------------------------------
General recommendations:
    Run OPTIMIZE TABLE to defragment tables for better performance
    Enable the slow query log to troubleshoot bad queries.
    Do not forget to disable slow query logging after troubleshooting
   - For MySQL 5.0 [url=http://dev.mysql.com/doc/refman/5.0/en/slow-query-log.html]MySQL :: MySQL 5.0 Reference Manual :: 5.2.4 The Slow Query Log[/url]
   - For MySQL 5.1 [url=http://dev.mysql.com/doc/refman/5.1/en/slow-query-log.html]MySQL :: MySQL 5.1 Reference Manual :: 5.2.5 The Slow Query Log[/url]
   - For MySQL 5.5 [url=http://dev.mysql.com/doc/refman/5.5/en/slow-query-log.html]MySQL :: MySQL 5.5 Reference Manual :: 5.2.5 The Slow Query Log[/url]
   - For MySQL 5.6 [url=http://dev.mysql.com/doc/refman/5.6/en/slow-query-log.html]MySQL :: MySQL 5.6 Reference Manual :: 5.2.5 The Slow Query Log[/url]
    Reduce or eliminate persistent connections to reduce connection usage
    When making adjustments, make tmp_table_size/max_heap_table_size equal
    Reduce your SELECT DISTINCT queries without LIMIT clauses
Variables to adjust:
    max_connections (> 100)
    wait_timeout (< 600)
    interactive_timeout (< 28800)
    query_cache_size (> 128M)
    tmp_table_size (> 160M, increase tmp_table_size)
    max_heap_table_size (> 160M, increase max_heap_table_size)
php -v
Code:
PHP 5.3.18 (cli) (built: Nov 17 2012 03:44:47)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Suhosin v0.9.33, Copyright (c) 2007-2012, by SektionEins GmbH[/HTML]

[B]/usr/local/cpanel/bin/rebuild_phpconf --current[/B]
[HTML]Available handlers: suphp dso cgi none
DEFAULT PHP: 5
PHP4 SAPI: none
PHP5 SAPI: suphp
SUEXEC: enabled
RUID2: not installed
public_html - error_log (alot of these):
Code:
[22-Nov-2012 03:11:36 UTC] PHP Fatal error:  Call to a member function get() on a non-object in /home/(**USERNAME**)/public_html/wp-includes/cache.php on line 113
grep -i "incorrect key" /var/lib/mysql/*.err
Code:
121109 17:54:58 [ERROR] /usr/sbin/mysqld: Incorrect key file for table './(**USERNAME**)_wp944/wp_mumsshopp_shopping.MYI'; try to repair it
121109 17:54:58 [ERROR] /usr/sbin/mysqld: Incorrect key file for table './(**USERNAME**)_wp944/wp_mumsshopp_shopping.MYI'; try to repair it
free -m
Code:
            total       used       free     shared    buffers     cached
Mem:          3072        471       2600          0          0          0
-/+ buffers/cache:        471       2600
Swap:            0          0          0
free -k
Code:
HTML Code:
             total       used       free     shared    buffers     cached
Mem:       3145728     481204    2664524          0          0          0
-/+ buffers/cache:     481204    2664524
Swap:            0          0          0
ps auxw
Code:
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   2164   652 ?        Ss   Nov05   0:02 init [3]
root      1587  0.0  0.2  13488  6480 ?        Ss   Nov17   0:24 /usr/local/apache/bin/httpd -k start -DSSL
root      3156  0.0  0.0   3720  1300 ?        S    Nov16   0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/(***vps_domain***)
mysql     3243  0.2  6.2 305032 196116 ?       Sl   Nov16  23:49 /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --log-error=/var/lib/mysql/(***vps_domain***)
root      9458  0.0  0.2  24172  6824 ?        Sl   Nov21   0:03 /usr/sbin/snmpd -Lsd -Lf /dev/null -p /var/run/snmpd.pid -a
root      9613  0.0  0.0   2268   628 ?        S<s  Nov05   0:00 /sbin/udevd -d
root      9739  0.0  1.0  32752 32736 ?        S<Lsl Nov05   0:00 iscsiuio
named    10011  0.0  0.1 195804  5444 ?        Ssl  Nov05   1:45 /usr/sbin/named -u named
root     10049  0.0  0.0   2840   864 ?        Ss   Nov05   0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
root     11706  0.0  0.0   2364   480 ?        Ss   Nov05   0:00 /usr/sbin/atd
root     11881  0.0  0.3  14840 10732 ?        S    Nov05   0:25 cpsrvd (SSL) - waiting for c --llu=1352309158 --listen=3,4,5,6,7,8
root     11987  0.0  0.6  25008 21620 ?        Ss   00:00   0:13 lfd - sleeping
root     13585  0.0  0.1   5136  3244 ?        S    Nov08   0:01 queueprocd - wait to process a task
root     13670  0.0  0.2  15616  8200 ?        S    Nov08   0:00 cpdavd - accepting connections on 2077 and 2078
root     13677  0.0  0.0   4336  1976 ?        SN   Nov08   0:00 cpanellogd - sleeping for logs
root     15677  0.0  0.0   4504  1128 ?        Ss   Nov15   0:01 crond
nobody   18071  0.0  0.1  13752  5488 ?        S    15:10   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     19657  0.0  0.1   8940  5720 ?        S    14:57   0:00 /usr/bin/perl /usr/local/cpanel/bin/leechprotect
root     19669  0.0  0.1  13488  3528 ?        S    14:57   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     21718  0.0  0.0   2164   708 ?        Ss   Nov08   1:14 /usr/sbin/dovecot
root     21719  0.0  0.0   2976  1368 ?        S    Nov08   3:18 dovecot-auth
dovecot  21854  0.0  0.0   6248  3112 ?        S    Nov08   0:34 pop3-login
dovecot  21855  0.0  0.1   6580  3540 ?        S    Nov08   2:03 pop3-login
dovecot  21856  0.0  0.0   5804  2612 ?        S    Nov08   0:01 imap-login
dovecot  21857  0.0  0.0   5668  2460 ?        S    Nov08   0:00 imap-login
nobody   22421  0.0  0.1  13752  5536 ?        S    15:13   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   23758  0.0  0.1  13752  5512 ?        S    15:13   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     24145  0.0  0.1   8720  4888 ?        S    Nov21   0:02 tailwatchd
nobody   24262  0.0  0.1  13752  5628 ?        S    15:14   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   24297  0.0  0.1  13744  5472 ?        S    15:14   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     26462  0.0  0.1  10112  3272 ?        Ss   15:01   0:00 sshd: [email protected]/0
root     26495  0.0  3.6 146916 115008 ?       Ssl  Nov21   0:18 /usr/sbin/clamd
mailnull 26504  0.0  0.0   9380  1124 ?        Ss   Nov21   0:00 /usr/sbin/exim -bd -q1h
root     27654  0.0  0.0   3828  1496 pts/0    Ss   15:01   0:00 -bash
root     27712  0.0  1.0  37760 31728 ?        Ss   Nov21   0:03 /usr/local/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid --max-children=3 --max-spa
nobody   27752  0.0  0.1  13752  5476 ?        S    15:15   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   27760  0.0  0.1  13752  5488 ?        S    15:15   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     27932  0.0  0.9  37948 31096 ?        S    Nov21   0:00 spamd child
nobody   28017  0.0  0.1  13728  5492 ?        S    15:16   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   28495  0.0  0.1  13744  5452 ?        S    15:16   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   28563  0.0  0.1  13752  5448 ?        S    15:16   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     30562  0.0  0.0   7248  1028 ?        Ss   Nov05   0:00 /usr/sbin/sshd
(**USERNAME**) 30651  0.0  0.0      0     0 ?        Z    15:17   0:00 [php] <defunct>
root     30652  0.0  0.0   2540   932 pts/0    R+   15:17   0:00 ps auxw
root     32730  0.0  0.0   5424  1480 ?        Ss   Nov05   0:02 pure-ftpd (SERVER)
root     32732  0.0  0.0   6220  1236 ?        S    Nov05   0:04 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/sbin/pureauth
top
Code:
top - 15:18:45 up 17 days, 10:58,  1 user,  load average: 1.19, 1.56, 2.18
Tasks:  50 total,   2 running,  46 sleeping,   0 stopped,   2 zombie
Cpu(s):  4.0%us,  0.5%sy,  0.0%ni, 95.5%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   3145728k total,   493560k used,  2652168k free,        0k buffers
Swap:        0k total,        0k used,        0k free,        0k cached
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
32421 (**USERNAME**)  17   0 29752  16m 5504 R  6.5  0.5   0:00.20 php
 3243 mysql     18   0  297m 191m 5344 S  0.7  6.2  23:49.31 mysqld
26462 root      18   0 10244 3284 2708 S  0.3  0.1   0:00.04 sshd
    1 root      15   0  2164  652  564 S  0.0  0.0   0:02.38 init
 1587 root      18   0 13488 6480 3072 S  0.0  0.2   0:24.30 httpd
 3156 root      18   0  3720 1300 1120 S  0.0  0.0   0:00.00 mysqld_safe
 9458 root      15   0 24172 6824 4264 S  0.0  0.2   0:03.69 snmpd
 9613 root      15  -4  2268  628  412 S  0.0  0.0   0:00.00 udevd
 9739 root      14 -10 32752  31m 1712 S  0.0  1.0   0:00.01 iscsiuio
10011 named     23   0  191m 5444 2080 S  0.0  0.2   1:45.34 named
10049 root      25   0  2840  864  688 S  0.0  0.0   0:00.00 xinetd
11706 root      18   0  2364  480  360 S  0.0  0.0   0:00.05 atd
11881 root      18   0 14840  10m 4336 S  0.0  0.3   0:25.15 cpsrvd-ssl
11987 root      18   0 25008  21m 1376 S  0.0  0.7   0:13.84 lfd
13585 root      15   0  5136 3244 1196 S  0.0  0.1   0:01.16 queueprocd
13670 root      15   0 15616 8200  460 S  0.0  0.3   0:00.31 cpdavd
13677 root      33  18  4336 1976  644 S  0.0  0.1   0:00.89 cpanellogd
15677 root      18   0  4504 1128  564 S  0.0  0.0   0:01.59 crond
18071 nobody    15   0 13752 5488 1832 S  0.0  0.2   0:00.29 httpd
19657 root      15   0  8940 5720 2032 S  0.0  0.2   0:00.06 leechprotect
19669 root      18   0 13488 3528  120 S  0.0  0.1   0:00.00 httpd
21718 root      18   0  2164  708  544 S  0.0  0.0   1:14.96 dovecot
21719 root      15   0  2976 1368  824 S  0.0  0.0   3:18.89 dovecot-auth
21854 dovecot   18   0  6248 3112 1792 S  0.0  0.1   0:34.90 pop3-login
21855 dovecot   18   0  6580 3540 1792 S  0.0  0.1   2:03.83 pop3-login
21856 dovecot   16   0  5804 2612 1652 S  0.0  0.1   0:01.27 imap-login
21857 dovecot   15   0  5668 2460 1652 S  0.0  0.1   0:00.34 imap-login
22421 nobody    15   0 13752 5536 1840 S  0.0  0.2   0:00.19 httpd
23758 nobody    18   0 13752 5516 1840 S  0.0  0.2   0:00.16 httpd
24145 root      18   0  8720 4888 1352 S  0.0  0.2   0:02.09 tailwatchd
24297 nobody    18   0 13744 5472 1832 S  0.0  0.2   0:00.14 httpd
26495 root      18   0  143m 112m 6808 S  0.0  3.7   0:18.68 clamd
26504 mailnull  18   0  9380 1124  644 S  0.0  0.0   0:00.08 exim
27654 root      16   0  3828 1496 1252 S  0.0  0.0   0:00.04 bash
27712 root      15   0 37760  30m 2488 S  0.0  1.0   0:03.05 spamd
27752 nobody    15   0 13752 5480 1828 S  0.0  0.2   0:00.13 httpd
27760 nobody    15   0 13752 5488 1828 S  0.0  0.2   0:00.10 httpd
netstat -an | grep :80|wc -l
Code:
186
netstat -an | grep :80 | grep -i syn | wc -l
Code:
2
netstat -an|grep :80|grep SYN|awk {'print $5'}|cut -d: -f 1|sort|uniq -c
Code:
 1 121.221.95.238
      1 209.145.114.163
tcpdump -nn 'tcp[13] == 2' and port 80 -c 100 -i any
Code:
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
15:22:24.129406 IP 202.63.42.158.53180 > 174.37.4.64.80: S 787121909:787121909(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:24.439016 IP 69.230.171.141.52537 > 174.37.4.64.80: S 2538290769:2538290769(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659861318 0,sackOK,eol>
15:22:24.484812 IP 202.63.42.158.53187 > 174.37.4.64.80: S 1654797116:1654797116(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:24.491465 IP 202.63.42.158.53188 > 174.37.4.64.80: S 3612185547:3612185547(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:24.505988 IP 69.230.171.141.52538 > 174.37.4.64.80: S 2928222927:2928222927(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659861377 0,sackOK,eol>
15:22:24.611087 IP 202.63.42.158.53189 > 174.37.4.64.80: S 98954051:98954051(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:24.716934 IP 202.63.42.158.53191 > 174.37.4.64.80: S 2900911099:2900911099(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.000184 IP 202.63.42.158.53192 > 174.37.4.64.80: S 3037289570:3037289570(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.023059 IP 202.63.42.158.53193 > 174.37.4.64.80: S 3829727140:3829727140(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.027313 IP 202.63.42.158.53194 > 174.37.4.64.80: S 4233844723:4233844723(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.137147 IP 202.63.42.158.53195 > 174.37.4.64.80: S 1459728389:1459728389(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.297009 IP 202.63.42.158.53196 > 174.37.4.64.80: S 2686498975:2686498975(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.519897 IP 69.230.171.141.52544 > 174.37.4.64.80: S 2118390810:2118390810(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659862263 0,sackOK,eol>
15:22:25.557563 IP 69.230.171.141.52546 > 174.37.4.64.80: S 3468565281:3468565281(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659862297 0,sackOK,eol>
15:22:25.660659 IP 202.63.42.158.53197 > 174.37.4.64.80: S 2494904397:2494904397(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:25.714223 IP 69.230.171.141.52549 > 174.37.4.64.80: S 2241809428:2241809428(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659862367 0,sackOK,eol>
15:22:26.080601 IP 202.63.42.158.53198 > 174.37.4.64.80: S 2949369337:2949369337(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:26.092652 IP 202.63.42.158.53199 > 174.37.4.64.80: S 1598047466:1598047466(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:26.204711 IP 202.63.42.158.53200 > 174.37.4.64.80: S 1441377083:1441377083(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:26.236774 IP 202.63.42.158.53201 > 174.37.4.64.80: S 367894627:367894627(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:26.586268 IP 202.63.42.158.53202 > 174.37.4.64.80: S 3620013025:3620013025(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:26.635384 IP 202.63.42.158.53203 > 174.37.4.64.80: S 3834614360:3834614360(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:26.635974 IP 69.230.171.141.52554 > 174.37.4.64.80: S 3517190672:3517190672(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863249 0,sackOK,eol>
15:22:26.636162 IP 69.230.171.141.52553 > 174.37.4.64.80: S 751952485:751952485(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863246 0,sackOK,eol>
15:22:26.665570 IP 76.27.106.150.44430 > 174.37.4.64.80: S 3297413257:3297413257(0) win 5840 <mss 1460,sackOK,timestamp 38466302 0,nop,wscale 5>
15:22:27.076406 IP 124.186.238.8.55284 > 174.37.4.64.80: S 4233853734:4233853734(0) win 65535 <mss 1452,nop,wscale 1,nop,nop,timestamp 1050290410 0,sackOK,eol>
15:22:27.204871 IP 69.230.171.141.52559 > 174.37.4.64.80: S 3597636691:3597636691(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863732 0,sackOK,eol>
15:22:27.216165 IP 69.230.171.141.52561 > 174.37.4.64.80: S 2162780538:2162780538(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863736 0,sackOK,eol>
15:22:27.216685 IP 69.230.171.141.52560 > 174.37.4.64.80: S 566470939:566470939(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863734 0,sackOK,eol>
15:22:27.221373 IP 69.230.171.141.52562 > 174.37.4.64.80: S 3364173591:3364173591(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863739 0,sackOK,eol>
15:22:27.223844 IP 69.230.171.141.52563 > 174.37.4.64.80: S 1004279675:1004279675(0) win 65535 <mss 1452,nop,wscale 4,nop,nop,timestamp 659863743 0,sackOK,eol>
15:22:27.224762 IP 76.27.106.150.46548 > 174.37.4.64.80: S 3301215208:3301215208(0) win 5840 <mss 1460,sackOK,timestamp 38466374 0,nop,wscale 5>
15:22:27.224818 IP 76.27.106.150.47611 > 174.37.4.64.80: S 3312727622:3312727622(0) win 5840 <mss 1460,sackOK,timestamp 38466374 0,nop,wscale 5>
15:22:27.229793 IP 76.27.106.150.36439 > 174.37.4.64.80: S 3297777775:3297777775(0) win 5840 <mss 1460,sackOK,timestamp 38466374 0,nop,wscale 5>
15:22:27.229817 IP 76.27.106.150.34375 > 174.37.4.64.80: S 3313694040:3313694040(0) win 5840 <mss 1460,sackOK,timestamp 38466374 0,nop,wscale 5>
15:22:27.229874 IP 76.27.106.150.34137 > 174.37.4.64.80: S 3304543968:3304543968(0) win 5840 <mss 1460,sackOK,timestamp 38466374 0,nop,wscale 5>
15:22:27.234376 IP 76.27.106.150.39175 > 174.37.4.64.80: S 3314025789:3314025789(0) win 5840 <mss 1460,sackOK,timestamp 38466375 0,nop,wscale 5>
15:22:27.289605 IP 76.27.106.150.41047 > 174.37.4.64.80: S 3298427146:3298427146(0) win 5840 <mss 1460,sackOK,timestamp 38466376 0,nop,wscale 5>
15:22:27.383247 IP 76.27.106.150.53310 > 174.37.4.64.80: S 3304092945:3304092945(0) win 5840 <mss 1460,sackOK,timestamp 38466394 0,nop,wscale 5>
15:22:27.452938 IP 76.27.106.150.38479 > 174.37.4.64.80: S 3302512769:3302512769(0) win 5840 <mss 1460,sackOK,timestamp 38466403 0,nop,wscale 5>
15:22:27.452963 IP 76.27.106.150.52342 > 174.37.4.64.80: S 3316905880:3316905880(0) win 5840 <mss 1460,sackOK,timestamp 38466403 0,nop,wscale 5>
15:22:27.453082 IP 76.27.106.150.52720 > 174.37.4.64.80: S 3311373153:3311373153(0) win 5840 <mss 1460,sackOK,timestamp 38466403 0,nop,wscale 5>
15:22:27.462525 IP 76.27.106.150.52776 > 174.37.4.64.80: S 3311563837:3311563837(0) win 5840 <mss 1460,sackOK,timestamp 38466404 0,nop,wscale 5>
15:22:27.467370 IP 76.27.106.150.60290 > 174.37.4.64.80: S 3317744553:3317744553(0) win 5840 <mss 1460,sackOK,timestamp 38466404 0,nop,wscale 5>
15:22:27.654440 IP 76.27.106.150.43614 > 174.37.4.64.80: S 3304866034:3304866034(0) win 5840 <mss 1460,sackOK,timestamp 38466428 0,nop,wscale 5>
15:22:27.800745 IP 76.27.106.150.60374 > 174.37.4.64.80: S 3308411973:3308411973(0) win 5840 <mss 1460,sackOK,timestamp 38466447 0,nop,wscale 5>
15:22:27.874568 IP 202.63.42.158.53209 > 174.37.4.64.80: S 3132676095:3132676095(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:27.875168 IP 202.63.42.158.53208 > 174.37.4.64.80: S 1764888658:1764888658(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:27.875177 IP 202.63.42.158.53207 > 174.37.4.64.80: S 3944261587:3944261587(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:27.880642 IP 202.63.42.158.53210 > 174.37.4.64.80: S 2867266351:2867266351(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:27.882479 IP 202.63.42.158.53211 > 174.37.4.64.80: S 3158808719:3158808719(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:27.904518 IP 76.27.106.150.56871 > 174.37.4.64.80: S 3323712988:3323712988(0) win 5840 <mss 1460,sackOK,timestamp 38466451 0,nop,wscale 5>
15:22:27.904584 IP 76.27.106.150.41046 > 174.37.4.64.80: S 3318914383:3318914383(0) win 5840 <mss 1460,sackOK,timestamp 38466460 0,nop,wscale 5>
15:22:28.000233 IP 76.27.106.150.42281 > 174.37.4.64.80: S 3320565598:3320565598(0) win 5840 <mss 1460,sackOK,timestamp 38466472 0,nop,wscale 5>
15:22:28.712124 IP 202.63.42.158.53231 > 174.37.4.64.80: S 3085390765:3085390765(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:28.722767 IP 202.63.42.158.53232 > 174.37.4.64.80: S 3814152076:3814152076(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:28.733516 IP 202.63.42.158.53233 > 174.37.4.64.80: S 1397559880:1397559880(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:28.735163 IP 202.63.42.158.53234 > 174.37.4.64.80: S 2896767407:2896767407(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:29.408608 IP 202.63.42.158.53241 > 174.37.4.64.80: S 1096091053:1096091053(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:29.409466 IP 202.63.42.158.53240 > 174.37.4.64.80: S 3013536879:3013536879(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
15:22:32.428157 IP 76.27.106.150.55852 > 174.37.4.64.80: S 3382139599:3382139599(0) win 5840 <mss 1460,sackOK,timestamp 38467038 0,nop,wscale 5>
15:22:32.428220 IP 76.27.106.150.56268 > 174.37.4.64.80: S 3385076078:3385076078(0) win 5840 <mss 1460,sackOK,timestamp 38467038 0,nop,wscale 5>
15:22:32.428233 IP 76.27.106.150.57388 > 174.37.4.64.80: S 3381514501:3381514501(0) win 5840 <mss 1460,sackOK,timestamp 38467038 0,nop,wscale 5>
15:22:32.468772 IP 76.27.106.150.49670 > 174.37.4.64.80: S 3390928883:3390928883(0) win 5840 <mss 1460,sackOK,timestamp 38467044 0,nop,wscale 5>
15:22:32.504951 IP 76.27.106.150.49281 > 174.37.4.64.80: S 3387034994:3387034994(0) win 5840 <mss 1460,sackOK,timestamp 38467049 0,nop,wscale 5>
15:22:32.622349 IP 76.27.106.150.36045 > 174.37.4.64.80: S 3392551947:3392551947(0) win 5840 <mss 1460,sackOK,timestamp 38467064 0,nop,wscale 5>
15:22:32.821505 IP 76.27.106.150.50031 > 174.37.4.64.80: S 3396205764:3396205764(0) win 5840 <mss 1460,sackOK,timestamp 38467090 0,nop,wscale 5>
15:22:33.184040 IP 76.27.106.150.50373 > 174.37.4.64.80: S 3392647844:3392647844(0) win 5840 <mss 1460,sackOK,timestamp 38467136 0,nop,wscale 5>
15:22:33.390856 IP 76.27.106.150.45220 > 174.37.4.64.80: S 3396731593:3396731593(0) win 5840 <mss 1460,sackOK,timestamp 38467161 0,nop,wscale 5>
15:22:33.452147 IP 76.27.106.150.47105 > 174.37.4.64.80: S 3398703531:3398703531(0) win 5840 <mss 1460,sackOK,timestamp 38467170 0,nop,wscale 5>
15:22:33.458025 IP 76.27.106.150.47606 > 174.37.4.64.80: S 3399289033:3399289033(0) win 5840 <mss 1460,sackOK,timestamp 38467170 0,nop,wscale 5>
15:22:33.839418 IP 76.27.106.150.34327 > 174.37.4.64.80: S 3408169604:3408169604(0) win 5840 <mss 1460,sackOK,timestamp 38467220 0,nop,wscale 5>
15:22:33.971841 IP 76.27.106.150.53487 > 174.37.4.64.80: S 3409079528:3409079528(0) win 5840 <mss 1460,sackOK,timestamp 38467237 0,nop,wscale 5>
15:22:33.993227 IP 76.27.106.150.44208 > 174.37.4.64.80: S 3416459614:3416459614(0) win 5840 <mss 1460,sackOK,timestamp 38467239 0,nop,wscale 5>
15:22:34.092385 IP 76.27.106.150.52344 > 174.37.4.64.80: S 3420858534:3420858534(0) win 5840 <mss 1460,sackOK,timestamp 38467250 0,nop,wscale 5>
15:22:34.092500 IP 76.27.106.150.37060 > 174.37.4.64.80: S 3414200518:3414200518(0) win 5840 <mss 1460,sackOK,timestamp 38467249 0,nop,wscale 5>
15:22:34.137347 IP 76.27.106.150.52828 > 174.37.4.64.80: S 3414716753:3414716753(0) win 5840 <mss 1460,sackOK,timestamp 38467258 0,nop,wscale 5>
15:22:34.180398 IP 76.27.106.150.55665 > 174.37.4.64.80: S 3406532351:3406532351(0) win 5840 <mss 1460,sackOK,timestamp 38467264 0,nop,wscale 5>
15:22:34.190145 IP 76.27.106.150.59133 > 174.37.4.64.80: S 3417717986:3417717986(0) win 5840 <mss 1460,sackOK,timestamp 38467265 0,nop,wscale 5>
15:22:34.242540 IP 76.27.106.150.43654 > 174.37.4.64.80: S 3409932922:3409932922(0) win 5840 <mss 1460,sackOK,timestamp 38467272 0,nop,wscale 5>
15:22:34.247720 IP 76.27.106.150.50364 > 174.37.4.64.80: S 3409929500:3409929500(0) win 5840 <mss 1460,sackOK,timestamp 38467272 0,nop,wscale 5>
15:22:34.396668 IP 76.27.106.150.35552 > 174.37.4.64.80: S 3409582443:3409582443(0) win 5840 <mss 1460,sackOK,timestamp 38467288 0,nop,wscale 5>
15:22:34.412901 IP 166.137.156.151.64563 > 174.37.4.64.80: S 740864219:740864219(0) win 5840 <mss 1460,sackOK,timestamp 177371609 0,nop,wscale 9>
tcpdump -Annvvs 1500 'tcp[13] == 2' and port 80 -c 100 -i any
Code:
15:23:29.165383 IP (tos 0x0, ttl  51, id 30216, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.49981 > 174.37.4.64.80: S, cksum 0x3aaa (correct), 3307986282:3307986282(0) win 65535 <mss 1420,nop,wscale 3,nop,nop,timestamp 35512171 0,sackOK,eol>
[email protected]@.3...;....%[email protected]=.P.+.j........:..............
...k........
15:23:29.316341 IP (tos 0x40, ttl 113, id 22894, offset 0, flags [DF], proto: TCP (6), length: 52) 202.63.42.158.53275 > 174.37.4.64.80: S, cksum 0x84bb (correct), 2912003356:2912003356(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
[email protected]@.q....?*..%[email protected] .................
15:23:29.320582 IP (tos 0x0, ttl  48, id 682, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53300 > 174.37.4.64.80: S, cksum 0xf595 (correct), 3038163919:3038163919(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698957351 0,sackOK,eol>
[email protected]@.0...J....%[email protected]
).>'........
15:23:29.634886 IP (tos 0x0, ttl  51, id 58169, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50000 > 174.37.4.64.80: S, cksum 0xa7bc (correct), 978385693:978385693(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512176 0,sackOK,eol>
[email protected]@.3...;....%[email protected]:P.........................
...p........
15:23:29.680678 IP (tos 0x0, ttl  51, id 21850, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50005 > 174.37.4.64.80: S, cksum 0xe6d3 (correct), 4212652856:4212652856(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512177 0,sackOK,eol>
[email protected]@.3.=.;....%[email protected]
...q........
15:23:29.685240 IP (tos 0x0, ttl  51, id 28276, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50006 > 174.37.4.64.80: S, cksum 0x6d08 (correct), 1737033874:1737033874(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512177 0,sackOK,eol>
[email protected]@.3.$t;....%[email protected]
...q........
15:23:30.010856 IP (tos 0x0, ttl  51, id 51550, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50010 > 174.37.4.64.80: S, cksum 0xab55 (correct), 1582814063:1582814063(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512180 0,sackOK,eol>
[email protected]^@.3...;....%[email protected]^W.o.........U.............
...t........
15:23:30.527017 IP (tos 0x0, ttl  51, id 31315, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50020 > 174.37.4.64.80: S, cksum 0x4c40 (correct), 3391932064:3391932064(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512185 0,sackOK,eol>
[email protected]@.3...;....%[email protected],[email protected]
...y........
15:23:30.528901 IP (tos 0x0, ttl  51, id 42354, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50021 > 174.37.4.64.80: S, cksum 0xe0d8 (correct), 607770618:607770618(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512185 0,sackOK,eol>
[email protected]@.3..u;....%[email protected]$9.........................
...y........
15:23:30.529807 IP (tos 0x0, ttl  51, id 41477, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50022 > 174.37.4.64.80: S, cksum 0xb1f2 (correct), 399774533:399774533(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512185 0,sackOK,eol>
[email protected]@.3...;....%[email protected]
...y........
15:23:30.963139 IP (tos 0x0, ttl  51, id 63339, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50023 > 174.37.4.64.80: S, cksum 0xceba (correct), 3675927345:3675927345(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512189 0,sackOK,eol>
[email protected]@.3..|;....%[email protected]
...}........
15:23:31.168744 IP (tos 0x0, ttl  51, id 20573, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50025 > 174.37.4.64.80: S, cksum 0x4654 (correct), 181177314:181177314(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512191 0,sackOK,eol>
[email protected]]@.3.B.;....%[email protected]
...........FT.............
............
15:23:31.226269 IP (tos 0x0, ttl  51, id 64075, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50026 > 174.37.4.64.80: S, cksum 0xe542 (correct), 337240996:337240996(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512192 0,sackOK,eol>
[email protected]@.3...;....%[email protected]
............
15:23:32.906323 IP (tos 0x40, ttl 111, id 21896, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55725 > 174.37.4.64.80: S, cksum 0x5600 (correct), 1111528340:1111528340(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l....U.%[email protected]@........ .V...............
15:23:32.906783 IP (tos 0x40, ttl 111, id 21897, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55726 > 174.37.4.64.80: S, cksum 0xbe0a (correct), 635324395:635324395(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l....U.%[email protected]%.G....... ..
..............
15:23:33.613127 IP (tos 0x0, ttl  48, id 49843, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53301 > 174.37.4.64.80: S, cksum 0x6c10 (correct), 164878301:164878301(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698961633 0,sackOK,eol>
[email protected]@.0...J....%[email protected]        ...........l..............
).N.........
15:23:33.838097 IP (tos 0x0, ttl  56, id 26462, offset 0, flags [DF], proto: TCP (6), length: 60) 174.36.241.149.45042 > 174.37.4.64.80: S, cksum 0x56b8 (correct), 494464609:494464609(0) win 14600 <mss 1460,sackOK,timestamp 549751103 0,nop,wscale 7>
E..<g^@.8..>.$...%[email protected]
 ..?........
15:23:33.927053 IP (tos 0x40, ttl 111, id 21915, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55728 > 174.37.4.64.80: S, cksum 0x8653 (correct), 2725905156:2725905156(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l....U.%[email protected] ..S..............
15:23:33.930587 IP (tos 0x40, ttl 111, id 21916, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55729 > 174.37.4.64.80: S, cksum 0x39e8 (correct), 2855421878:2855421878(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l....U.%[email protected] .9...............
15:23:33.931262 IP (tos 0x40, ttl 111, id 21917, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55730 > 174.37.4.64.80: S, cksum 0xad34 (correct), 689853821:689853821(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l....U.%[email protected]).U}...... ..4..............
15:23:33.932208 IP (tos 0x40, ttl 111, id 21918, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55731 > 174.37.4.64.80: S, cksum 0x43c4 (correct), 3481016462:3481016462(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l....U.%[email protected]|........ .C...............
15:23:33.953484 IP (tos 0x40, ttl 113, id 22909, offset 0, flags [DF], proto: TCP (6), length: 52) 202.63.42.158.53276 > 174.37.4.64.80: S, cksum 0x42bb (correct), 2976506691:2976506691(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
[email protected]}@.q....?*..%[email protected] .B...............
15:23:34.160119 IP (tos 0x0, ttl  48, id 49613, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53302 > 174.37.4.64.80: S, cksum 0x0c34 (correct), 754586240:754586240(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962163 0,sackOK,eol>
[email protected]@.0...J....%[email protected],............4.............
).P.........
15:23:34.163525 IP (tos 0x0, ttl  48, id 59372, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53303 > 174.37.4.64.80: S, cksum 0xca1f (correct), 3436098748:3436098748(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962165 0,sackOK,eol>
[email protected]@.0...J....%[email protected]
).P.........
15:23:34.166235 IP (tos 0x0, ttl  48, id 5522, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53304 > 174.37.4.64.80: S, cksum 0x84f8 (correct), 639475858:639475858(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962167 0,sackOK,eol>
[email protected]@.0...J....%[email protected]&..........................
).P.........
15:23:34.169441 IP (tos 0x0, ttl  48, id 37028, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53305 > 174.37.4.64.80: S, cksum 0xbc58 (correct), 2612589460:2612589460(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962168 0,sackOK,eol>
[email protected]@.0...J....%[email protected]
).P.........
15:23:34.173875 IP (tos 0x0, ttl  48, id 33703, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53306 > 174.37.4.64.80: S, cksum 0x31bb (correct), 3925553125:3925553125(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962177 0,sackOK,eol>
[email protected]@.0.&.J....%[email protected]:.P../.........1..............
).Q.........
15:23:34.194308 IP (tos 0x0, ttl  48, id 32732, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53307 > 174.37.4.64.80: S, cksum 0x295f (correct), 3823517248:3823517248(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962198 0,sackOK,eol>
[email protected]@.0.*.J....%[email protected];.P..>@........)_.............
).Q.........
15:23:34.229298 IP (tos 0x0, ttl  51, id 54788, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50033 > 174.37.4.64.80: S, cksum 0xd4c9 (correct), 2764464971:2764464971(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512222 0,sackOK,eol>
[email protected]@.3...;....%[email protected]
............
15:23:34.249668 IP (tos 0x0, ttl  51, id 10535, offset 0, flags [DF], proto: TCP (6), length: 64) 59.167.198.195.50036 > 174.37.4.64.80: S, cksum 0xe017 (correct), 1708234479:1708234479(0) win 65535 <mss 1420,nop,wscale 1,nop,nop,timestamp 35512222 0,sackOK,eol>
[email protected])'@.3.i.;....%[email protected]
............
15:23:34.259285 IP (tos 0x40, ttl 113, id 22910, offset 0, flags [DF], proto: TCP (6), length: 52) 202.63.42.158.53277 > 174.37.4.64.80: S, cksum 0xbc7b (correct), 2651290852:2651290852(0) win 8192 <mss 1452,nop,wscale 8,nop,nop,sackOK>
[email protected][email protected]?*..%[email protected]|....... ..{..............
15:23:34.416380 IP (tos 0x40, ttl 111, id 21973, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55738 > 174.37.4.64.80: S, cksum 0xfd35 (correct), 1403116272:1403116272(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.lk...U.%[email protected] ..5..............
15:23:34.452522 IP (tos 0x0, ttl  48, id 34445, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53310 > 174.37.4.64.80: S, cksum 0x0f11 (correct), 3367924432:3367924432(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962425 0,sackOK,eol>
[email protected]@.0.#.J....%[email protected]>.P..r........................
).Q.........
15:23:34.463467 IP (tos 0x40, ttl  48, id 55225, offset 0, flags [DF], proto: TCP (6), length: 64) 124.186.238.8.59007 > 174.37.4.64.80: S, cksum 0x6bb6 (correct), 329402293:329402293(0) win 65535 <mss 1452,nop,wscale 1,nop,nop,timestamp 1050357096 0,sackOK,eol>
[email protected]@[email protected]|....%[email protected]
>.-h........
15:23:34.530366 IP (tos 0x40, ttl  48, id 24764, offset 0, flags [DF], proto: TCP (6), length: 64) 124.186.238.8.52751 > 174.37.4.64.80: S, cksum 0xaf8d (correct), 3812052086:3812052086(0) win 65535 <mss 1452,nop,wscale 1,nop,nop,timestamp 1050357162 0,sackOK,eol>
[email protected]@`[email protected]|....%[email protected]
>.-.........
15:23:34.624540 IP (tos 0x40, ttl 111, id 21984, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55739 > 174.37.4.64.80: S, cksum 0x9c83 (correct), 2279606115:2279606115(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l`...U.%[email protected] .................
15:23:34.642089 IP (tos 0x40, ttl 111, id 21990, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55740 > 174.37.4.64.80: S, cksum 0xee5c (correct), 891947071:891947071(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.lZ...U.%[email protected]*.?...... ..\..............
15:23:34.712143 IP (tos 0x40, ttl  48, id 41186, offset 0, flags [DF], proto: TCP (6), length: 64) 124.186.238.8.62780 > 174.37.4.64.80: S, cksum 0x99f0 (correct), 2021565675:2021565675(0) win 65535 <mss 1452,nop,wscale 1,nop,nop,timestamp 1050357342 0,sackOK,eol>
[email protected]@[email protected]|....%[email protected]<.Px~.........................
>..^........
15:23:34.823098 IP (tos 0x40, ttl 111, id 22009, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55741 > 174.37.4.64.80: S, cksum 0x10e8 (correct), 1806020407:1806020407(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.lG...U.%[email protected] .................
15:23:34.834899 IP (tos 0x0, ttl  48, id 56282, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53313 > 174.37.4.64.80: S, cksum 0x35b5 (correct), 348520139:348520139(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962768 0,sackOK,eol>
[email protected]@.0...J....%[email protected]
).SP........
15:23:34.837549 IP (tos 0x0, ttl  48, id 15757, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53314 > 174.37.4.64.80: S, cksum 0xbaf3 (correct), 36998171:36998171(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962770 0,sackOK,eol>
[email protected][email protected]%[email protected]
).SR........
15:23:34.844037 IP (tos 0x0, ttl  48, id 2180, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53315 > 174.37.4.64.80: S, cksum 0x2201 (correct), 215751262:215751262(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962777 0,sackOK,eol>
[email protected]@.0...J....%[email protected]^........"..............
).SY........
15:23:34.860533 IP (tos 0x0, ttl  48, id 1459, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53316 > 174.37.4.64.80: S, cksum 0x3c6a (correct), 1152174100:1152174100(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962792 0,sackOK,eol>
[email protected]@.0...J....%[email protected]<j.............
).Sh........
15:23:34.862516 IP (tos 0x0, ttl  48, id 21490, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53317 > 174.37.4.64.80: S, cksum 0xc955 (correct), 4056845828:4056845828(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962793 0,sackOK,eol>
[email protected]@.0.V.J....%[email protected].....U.............
).Si........
15:23:34.865517 IP (tos 0x40, ttl 111, id 22017, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55742 > 174.37.4.64.80: S, cksum 0x105c (correct), 1582939406:1582939406(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l?...U.%[email protected]^Y........ ..\..............
15:23:34.877529 IP (tos 0x0, ttl  48, id 44731, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53318 > 174.37.4.64.80: S, cksum 0xa206 (correct), 3986864496:3986864496(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962807 0,sackOK,eol>
[email protected]@.0...J....%[email protected]
).Sw........
15:23:34.995685 IP (tos 0x40, ttl 111, id 22027, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55743 > 174.37.4.64.80: S, cksum 0x96b1 (correct), 312509041:312509041(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l5...U.%[email protected] .................
15:23:35.049100 IP (tos 0x0, ttl  47, id 57272, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53319 > 174.37.4.64.80: S, cksum 0x3908 (correct), 3071498343:3071498343(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962957 0,sackOK,eol>
[email protected]@./...J....%[email protected]
........
15:23:35.065728 IP (tos 0x0, ttl  48, id 33256, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53320 > 174.37.4.64.80: S, cksum 0x6af5 (correct), 2001495603:2001495603(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962970 0,sackOK,eol>
[email protected]@.0.(.J....%[email protected]
).T.........
15:23:35.080299 IP (tos 0x0, ttl  47, id 49603, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53321 > 174.37.4.64.80: S, cksum 0x5840 (correct), 495047333:495047333(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698962983 0,sackOK,eol>
[email protected]@./...J....%[email protected]@.............
).T'........
15:23:35.091728 IP (tos 0x40, ttl 111, id 22038, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55744 > 174.37.4.64.80: S, cksum 0x8c84 (correct), 3299531410:3299531410(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l*...U.%[email protected] .................
15:23:35.099149 IP (tos 0x40, ttl 111, id 22041, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55745 > 174.37.4.64.80: S, cksum 0x83de (correct), 533366808:533366808(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.l'...U.%[email protected] .................
15:23:35.152518 IP (tos 0x0, ttl  48, id 52958, offset 0, flags [DF], proto: TCP (6), length: 64) 74.240.162.225.53322 > 174.37.4.64.80: S, cksum 0xdb58 (correct), 3581384542:3581384542(0) win 65535 <mss 1452,nop,wscale 2,nop,nop,timestamp 698963038 0,sackOK,eol>
[email protected]@.0...J....%[email protected]^.........X.............
).T^........
15:23:35.305570 IP (tos 0x40, ttl 111, id 22050, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55748 > 174.37.4.64.80: S, cksum 0xcf36 (correct), 1208030342:1208030342(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]"@.o.l....U.%[email protected] ..6..............
15:23:35.312240 IP (tos 0x40, ttl 111, id 22057, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55749 > 174.37.4.64.80: S, cksum 0xf8aa (correct), 942602979:942602979(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected])@.o.l....U.%[email protected] .................
15:23:35.317861 IP (tos 0x40, ttl 111, id 22060, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55750 > 174.37.4.64.80: S, cksum 0xf3c6 (correct), 662311035:662311035(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected],@.o.l....U.%[email protected]'z.{...... .................
15:23:35.786496 IP (tos 0x40, ttl 111, id 22089, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55753 > 174.37.4.64.80: S, cksum 0x64f0 (correct), 539010728:539010728(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.k....U.%[email protected]..P  ........ .d...............
15:23:36.000037 IP (tos 0x40, ttl 111, id 22104, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55758 > 174.37.4.64.80: S, cksum 0x8679 (correct), 1646674708:1646674708(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.k....U.%[email protected]&C....... ..y..............
15:23:36.066136 IP (tos 0x40, ttl 111, id 22111, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55759 > 174.37.4.64.80: S, cksum 0x5da3 (correct), 2827101581:2827101581(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected][email protected]%[email protected]%....... .]...............
15:23:36.213280 IP (tos 0x40, ttl 111, id 22118, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55760 > 174.37.4.64.80: S, cksum 0x963e (correct), 1477983579:1477983579(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.k....U.%[email protected]=[...... ..>..............
15:23:36.249998 IP (tos 0x40, ttl 111, id 22126, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55761 > 174.37.4.64.80: S, cksum 0xc17d (correct), 2671495927:2671495927(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.k....U.%[email protected];........ ..}..............
15:23:36.463490 IP (tos 0x40, ttl 111, id 22141, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55762 > 174.37.4.64.80: S, cksum 0xb31c (correct), 1547181147:1547181147(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]}@.o.k....U.%[email protected]\8.[...... .................
15:23:36.516995 IP (tos 0x40, ttl 111, id 22146, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55763 > 174.37.4.64.80: S, cksum 0x98b7 (correct), 3575430618:3575430618(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.k....U.%[email protected] .................
15:23:36.681757 IP (tos 0x40, ttl 111, id 22163, offset 0, flags [DF], proto: TCP (6), length: 52) 144.137.6.85.55765 > 174.37.4.64.80: S, cksum 0xb0b2 (correct), 940196592:940196592(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
[email protected]@.o.k....U.%[email protected]
B....... .................
100 packets captured
102 packets received by filter
0 packets dropped by kernel
grep -i maxclient /usr/local/apache/logs/error_log
Code:
[Fri Nov 09 15:09:43 2012] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Sun Nov 11 18:26:35 2012] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Sat Nov 17 16:45:28 2012] [error] server reached MaxClients setting, consider raising the MaxClients setting
/var/log/messages
Code:
nothing
/var/log/dmesg
Code:
nothing
/usr/local/apache/domlogs/(**USERNAME**)im.com.au
Code:
I have this if you need me to upload to web server to view
httpd -l
Code:
Compiled in modules:
  core.c
  mod_authn_file.c
  mod_authn_default.c
  mod_authz_host.c
  mod_authz_groupfile.c
  mod_authz_user.c
  mod_authz_default.c
  mod_auth_basic.c
  mod_cache.c
  mod_mem_cache.c
  mod_include.c
  mod_filter.c
  mod_log_config.c
  mod_logio.c
  mod_env.c
  mod_expires.c
  mod_headers.c
  mod_unique_id.c
  mod_setenvif.c
  mod_version.c
  mod_proxy.c
  mod_proxy_connect.c
  mod_proxy_ftp.c
  mod_proxy_http.c
  mod_proxy_scgi.c
  mod_proxy_ajp.c
  mod_proxy_balancer.c
  mod_ssl.c
  prefork.c
  http_core.c
  mod_mime.c
  mod_status.c
  mod_autoindex.c
  mod_asis.c
  mod_info.c
  mod_suexec.c
  mod_cgi.c
  mod_negotiation.c
  mod_dir.c
  mod_actions.c
  mod_userdir.c
  mod_alias.c
  mod_rewrite.c
  mod_so.c
httpd -M | grep -i fcgi
Code:
HTML Code:
Syntax OK
httpd -l | grep -i fcgi
…[email protected](user) [~]#

ls -l /usr/local/apache/modules
Code:
total 9100
drwxr-xr-x  2 root root    4096 Nov 17 03:45 ./
drwxr-xr-x 18 root root    4096 Nov 17 03:48 ../
-rw-r--r--  1 root root    9170 Nov 17 03:37 httpd.exp
-rwxr-xr-x  1 root root 8778442 Nov 17 03:45 libphp5.so*
-rwxr-xr-x  1 root root    7622 Nov 17 03:38 mod_auth_passthrough.so*
-rwxr-xr-x  1 root root    6836 Nov 17 03:38 mod_bwlimited.so*
-rwxr-xr-x  1 root root    4183 Nov 17 03:38 mod_disable_suexec.so*
-rwxr-xr-x  1 root root   11275 Nov 17 03:39 mod_fastinclude.so*
-rwxr-xr-x  1 root root   43270 Nov 17 03:40 mod_frontpage.so*
-rwxr-xr-x  1 root root  386832 Nov 17 03:41 mod_security2.so*
-rwxr-xr-x  1 root root   22883 Nov 17 03:40 mod_suphp.so*
ps aux | grep php
Code:
root      5931  0.0  0.0   3104   720 pts/0    S+   15:50   0:00 grep php
(**USERNAME**) 27857  0.0  0.0      0     0 ?        Z    15:46   0:00 [php] <defunct>
grep Commit /proc/meminfo
Code:
CommitLimit: 0 kB
Committed_AS: 818780 kB
 

xman888

Well-Known Member
Nov 23, 2005
61
1
158
Hi guys,

Did anyone have any ideas with this?

My etc/my.cnf file is:

Code:
[mysqld]
max_connections = 200
innodb_file_per_table = 1
wait_timeout = 600
query_cache_limit = 2M
query_cache_size = 128M
query_cache_type = 1
tmp_table_size = 320M
max_heap_table_size = 320M
thread_cache_size = 16
table_open_cache = 128
key_buffer_size = 48M
read_buffer_size = 128K
join_buffer_size = 128K
connect_timeout = 5
max_connect_errors = 7
max_allowed_packet = 1M
slow-query-log
I had huge server load issues (50 to 100) when I changed: max_connections to 500. I have since changed it back to 200 (and restarted mysql), which has definitely helped, however I noticed that the number of MYSQL connections is still going over 200 - see attached.

Does anyone have some good advise for me going forwards?

Kind regards,
Anthony
 

Attachments