My apache is maxing out but not showing what user is doing it or the page:
0-0 22882 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
1-0 22883 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
2-0 22884 0/15/15 R 0.02 278 0 0.0 0.13 0.13 ? ? ..reading..
3-0 22885 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
4-0 22886 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
5-0 22897 0/1/1 R 0.00 12 0 0.0 0.00 0.00 ? ? ..reading..
The dos attack is connected like this:
23920/httpd
tcp 0 0 66.123.123.12:80 68.42.198.99:3595 ESTABLISHED -
tcp 0 0 66.123.123.12:80 68.42.198.99:1800 ESTABLISHED 23943/httpd
tcp 0 0 66.123.123.12:80 68.42.198.99:3337 ESTABLISHED -
tcp 0 0 66.123.123.12:80 68.42.198.99:3081 ESTABLISHED -
tcp 0 0 66.123.123.12:80 68.42.198.99:1289 ESTABLISHED
I blocked the i.p. but is there another way to prevent this?
Thanks, Chaze
0-0 22882 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
1-0 22883 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
2-0 22884 0/15/15 R 0.02 278 0 0.0 0.13 0.13 ? ? ..reading..
3-0 22885 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
4-0 22886 0/0/0 R 0.00 13 0 0.0 0.00 0.00 ? ? ..reading..
5-0 22897 0/1/1 R 0.00 12 0 0.0 0.00 0.00 ? ? ..reading..
The dos attack is connected like this:
23920/httpd
tcp 0 0 66.123.123.12:80 68.42.198.99:3595 ESTABLISHED -
tcp 0 0 66.123.123.12:80 68.42.198.99:1800 ESTABLISHED 23943/httpd
tcp 0 0 66.123.123.12:80 68.42.198.99:3337 ESTABLISHED -
tcp 0 0 66.123.123.12:80 68.42.198.99:3081 ESTABLISHED -
tcp 0 0 66.123.123.12:80 68.42.198.99:1289 ESTABLISHED
I blocked the i.p. but is there another way to prevent this?
Thanks, Chaze
Last edited: