The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Help I´m Getting my server slammed with hundreds of connections

Discussion in 'E-mail Discussions' started by kran, Dec 4, 2007.

  1. kran

    kran Well-Known Member

    Joined:
    Jul 5, 2003
    Messages:
    74
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Colombia
    cPanel Access Level:
    Root Administrator
    Since about a Week I´m getting 3 of my servers hit with many connections from the same Ip´s and they endup overloading the server to a halt.

    I´ve keep putting this ips in the deny list of csf firewall but they come with new ips.

    I have spamassasing active, chirpys dictionary, the new ACL´s.

    There is any way I can limit the SMTP connection per IP to let´s say 50 or less?

    This is how the log looks.


    2007-12-04 10:51:50 [7984] SMTP connection from [89.167.46.28]:1128 I=[64.191.xx.xx]:25 (TCP/IP connection count = 74)
    2007-12-04 10:51:50 [7984] SMTP connection from [65.70.74.193]:50463 I=[64.191.xx.xx]:25 (TCP/IP connection count = 75)
    2007-12-04 10:51:50 [7984] SMTP connection from [190.28.127.202]:1324 I=[64.191.xx.xx]:25 (TCP/IP connection count = 76)
    2007-12-04 10:51:50 [7984] SMTP connection from [209.89.64.169]:62647 I=[64.191.xx.xx]:25 (TCP/IP connection count = 77)
    2007-12-04 10:51:50 [7984] SMTP connection from [207.108.77.2]:11893 I=[64.191.xx.xx]:25 (TCP/IP connection count = 78)
    2007-12-04 10:51:50 [7984] SMTP connection from [66.162.37.243]:45770 I=[64.191.xx.xx]:25 (TCP/IP connection count = 79)
    2007-12-04 10:51:50 [7984] SMTP connection from [64.18.2.169]:53720 I=[64.191.xx.xx]:25 (TCP/IP connection count = 80)
    2007-12-04 10:51:50 [7984] SMTP connection from [194.151.226.36]:47496 I=[64.191.xx.xx]:25 (TCP/IP connection count = 81)
    2007-12-04 10:51:50 [7984] SMTP connection from [201.234.137.188]:1611 I=[64.191.xx.xx]:25 (TCP/IP connection count = 82)
    2007-12-04 10:51:50 [7984] SMTP connection from [201.234.137.188]:1612 I=[64.191.xx.xx]:25 (TCP/IP connection count = 83)
    2007-12-04 10:51:50 [7984] SMTP connection from [61.218.236.210]:57730 I=[64.191.xx.xx]:25 (TCP/IP connection count = 84)
    2007-12-04 10:51:50 [7984] SMTP connection from [88.76.197.10]:1602 I=[64.191.xx.xx]:25 (TCP/IP connection count = 85)
    2007-12-04 10:51:50 [7984] SMTP connection from [201.234.137.188]:1616 I=[64.191.xx.xx]:25 (TCP/IP connection count = 86)
    2007-12-04 10:51:50 [7984] SMTP connection from [83.110.53.49]:3696 I=[64.191.xx.xx]:25 (TCP/IP connection count = 87)
    2007-12-04 10:51:51 [7984] SMTP connection from [59.95.195.241]:54948 I=[64.191.xx.xx]:25 (TCP/IP connection count = 88)
    2007-12-04 10:51:51 [7984] SMTP connection from [66.0.0.68]:27853 I=[64.191.xx.xx]:25 (TCP/IP connection count = 89)
     
  2. serversignature

    serversignature Well-Known Member

    Joined:
    Nov 26, 2007
    Messages:
    107
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Bangalore
  3. kran

    kran Well-Known Member

    Joined:
    Jul 5, 2003
    Messages:
    74
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Colombia
    cPanel Access Level:
    Root Administrator
    Thank you

    I modified smtp_accept_max_per_host and it seems to help a lot.
     
  4. jarodlwk

    jarodlwk Active Member

    Joined:
    Sep 24, 2006
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    I have the same problem. I have set my smtp_accept_max_per_host = 15 and smtp_accept_max = 50. But I still get the logs as below:

    SMTP connection from [218.208.230.103] (TCP/IP connection count = 48)
    SMTP connection from [58.9.144.183] (TCP/IP connection count = 49)
    SMTP connection from [143.166.224.119] (TCP/IP connection count = 49)
    SMTP connection from [68.161.206.234] (TCP/IP connection count = 50)

    The max connection does not exceed the limit of 50 but each host exceeded the limit of 15. What did I do wrong?
     
Loading...

Share This Page