Local Connection Flood Causes Outage

[Solokron]

Viewing both netstat and access logs I am seeing a flood of these connections on a server:

127.0.0.1 - - [25/Aug/2013:16:21:03 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:04 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:04 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:05 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:05 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:06 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:06 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:07 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:07 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:08 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:08 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:09 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:09 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:10 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:10 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:24 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:24 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:25 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:25 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:26 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:26 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:27 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:27 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:28 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:28 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:29 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:29 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:38 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:38 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:39 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:39 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:45 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:45 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:46 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:46 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:47 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:47 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:48 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:48 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:50 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:50 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:51 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:21:51 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:22:05 -0700] "OPTIONS * HTTP/1.0" 200 -
127.0.0.1 - - [25/Aug/2013:16:22:05 -0700] "OPTIONS * HTTP/1.0" 200 -

There are so many that it results in the network service going down and I need to be at the server and run a "service network restart" to bring the server back up. Sounds like it is running out of TCP ports. Any ideas on tracking down the root cause of this?

 

[Solokron]

Looks like it is just polling. I'll keep looking.

 

[cPanelMichael]

Hello

The following post should be useful to you:

Options Requests

Thank you.