Local Connection Flood Causes Outage

Solokron

Well-Known Member
Aug 8, 2003
851
1
168
Seattle
cPanel Access Level
DataCenter Provider
Viewing both netstat and access logs I am seeing a flood of these connections on a server:

Code:
127.0.0.1 - - [25/Aug/2013:16:21:03 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:04 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:04 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:05 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:05 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:06 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:06 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:07 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:07 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:08 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:08 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:09 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:09 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:10 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:10 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:24 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:24 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:25 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:25 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:26 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:26 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:27 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:27 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:28 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:28 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:29 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:29 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:38 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:38 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:39 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:39 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:45 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:45 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:46 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:46 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:47 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:47 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:48 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:48 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:50 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:50 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:51 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:51 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:22:05 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:22:05 -0700] "OPTIONS * HTTP/1.0" 200 -
There are so many that it results in the network service going down and I need to be at the server and run a "service network restart" to bring the server back up. Sounds like it is running out of TCP ports. Any ideas on tracking down the root cause of this?
 

Solokron

Well-Known Member
Aug 8, 2003
851
1
168
Seattle
cPanel Access Level
DataCenter Provider
Looks like it is just polling. I'll keep looking.