Help! One of my client's servers is performing peculiarly slow for the last hour and it seems apache is the culprit. We have restarted apache several times but it just keeps slowing back after 5mins. I know netstat will indicate a sign but how do I interpet the data and how should I be querying data? TIA

You'll need to determine which IP has the most TCP connections to your port 80.

It should display unique IPs connecting to your port 80 and count how many each at a time. You can then start investigating the IP with the most connections.

Try not concentrate only on the TCP data, check your apache logs as well for which files are being accessed. This can help you narrow down and profile the attacker more i.e. wether he is brute forcing a script on your server, gather his attack pattern, etc.

Hope this helps.

Hi swordfish, thanks for the code. I am seeing 5 to 10 IPs with each more than a hundred connections each. One question though, how do I differentiate the legitimate users from the culprit?

Be careful with interpreting data, you might be thinking of legitimate users as the culprit to DoSing your server.

As swordfish says carefully inspect your access and error logs, consolidate hourly data for each IP. One thing to look our for the culprit based on my experience are bogus HTTP requests which are very hard to detect from the server level. Also lookout for out of the norm apache error responses from your logs i.e. aside from 500 and 404, some uncomon apache error codes could've shown up at your logs from the last hour or so.

__________________
···dotmanila···

+1 with zoticai+c, it would be harder for you on this level as you could be buried with the wrong assumption and be locking legitimate users.

It would also help asking assistance from your network administratot/engineer. I would assume bringing attention of DoS to your server is that it is a busy and well visited website(s) and it is as well behind a managed network. From this point your network administrators/engineers can inspect the packets from the switch/firewall your server connects on.

Apparently, asking help from the network engineers incurs costs and I had to get authorization from the client. They are investigating the attack as I type.

However I still need to investigate this myself and give it a shot from the server level. I agree it will be harder but this can be a sort of training as well.

Well goodluck there mate, and please post your findings here if you can so others can benefit

__________________
···dotmanila···