netstat - possible reasons for high IP count ??? Post: 302260039

Sponsored Content

Special Forums IP Networking netstat - possible reasons for high IP count ??? Post 302260039 by PWSwebmaster on Wednesday 19th of November 2008 12:59:07 PM

11-19-2008

Registered User

It's been different files and scripts, but mostly just files, being accessed at a high count of one IP like that.

Here's an example from log files for one case:

Quote:

60.50.105.33 - - [18/Nov/2008:08:45:04 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 91022 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
60.50.105.33 - - [18/Nov/2008:08:45:06 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 227228 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
60.50.105.33 - - [18/Nov/2008:08:45:13 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 115944 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
60.50.105.33 - - [18/Nov/2008:08:45:14 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 157814 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
60.50.105.33 - - [18/Nov/2008:08:45:17 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 156708 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
60.50.105.33 - - [18/Nov/2008:08:45:17 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 203672 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"
60.50.105.33 - - [18/Nov/2008:08:45:17 -0500] "GET /uploads/2476/2008_TEB_-11-_Alban_Preaubert_FS.avi HTTP/1.1" 206 198600 "http://www.skatingvideoclips.com/uploads/2476" "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)"

Netstat showed that IP many times, so it wasn't their computer downloading a video a bit at a time. It looked more like they were downloading the same video a high number of times at once. There are about 400 videos there, so it wasn't 50 different people with the same OS and same gateway downloading the same video at the same time.

That IP is from Malaysia.
The host is: 33.105.50.60.klj03-home.tm.net.my and is probably from MY (MALAYSIA)

Most of the high count IPs have been from Malaysia, Taiwan, Poland, Japan and China.

When the server first started having high load trouble, I found the high number of connections to one file and renamed the file, then minutes later the same IP would have a high number of connections to a different file, then I blocked the IP from that site and minutes later the same file was being accessed a high number of times from a different IP. I wrote a little script to block IPs from that site automatically, then the IP would just keep changing and show as being from different countries. The script would just block access to the one site which meant giving a 403 page each time. Next thing I knew, the volume was climbing and they were just getting the 403 page 100 times a second. Definitely looked to me like someone was trying to crash the server, so I had to look into blocking them from the whole server.

Since I started running my auto iptables script a week ago, the server load has pretty much quit spiking.

The odds of many people from one company on the same router going to a site at the same time is quite slim, but later on I can adjust my script to check the log files to see if the IPs are all accessing the same file and using the same browser which would help prevent them from being blocked.

PWSwebmaster

View Public Profile for PWSwebmaster

Find all posts by PWSwebmaster

7 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Sun: High kernel usage & very high load averages

Hi, I am seeing very high kernel usage and very high load averages on my system (Although we are not loading much data to our database). Here is the output of top...does anyone know what i should be looking at? Thanks, Lorraine last pid: 13144; load averages: 22.32, 19.81, 16.78 ...

2. Solaris

To find out the reasons it crash

What are the steps to find out the reasons it crash in the solaris machine

3. Shell Programming and Scripting

cron job not working for some reasons

I set up a new cron job. I have set cron jobs many times in the past and never faced issues. For some reasons my new cron job is not working.This is how my cron job looks like. plz help me out guys. 3,8,13,18,23,28,33,38,43,48,53,58 * * * * /siebel/sblp900/home/FSMTaskChk/script...

4. Ubuntu

Kubuntu on (certain) Lenovo laptops not possible - reasons?

Hi. I've used the Wubi install of Ubuntu and Kubuntu on my Windows XP machine for close to half a year now. My brother has let me know of a program where he works by which they're getting rid of (with support negated) several Lenovo laptops, on which, he also informs me, the K 'flavor' of Ubuntu...

5. Red Hat

apache high cpu load on high traffic

i have a Intel Quad Core Xeon X3440 (4 x 2.53GHz, 8MB Cache, Hyper Threaded) with 16gig and 1tb harddrive with a 1gb port and my apache is causing my cpu to go up to 100% on all four cores heres my http.config <IfModule prefork.c> StartServers 10 MinSpareServers 10 MaxSpareServers 15...

6. Solaris

Reasons for NOT using LDOMs? reliability?

Dear Solaris Experts, We are upgrading from sun4u to T4 systems and one proposal is to use LDOMs and also zones within LDOMs. Someone advised using only zones and not LDOMs because the new machines have fewer chips and if a chip or a core fails then it doesn't impact the zones, but impacts...

7. Shell Programming and Scripting

Count no of netstat states

netstat | awk '/server/ {for(i=1;i<2;i++) {getline;print}' Output: ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED TIME_WAIT TIME_WAIT From the above command I'm getting all the states. I want to count the states and write to a file, like "Count of ESTABLISHED...

LEARN ABOUT X11R4

inet_type

inet_type(4)                                                       File Formats                                                       inet_type(4)

NAME

       inet_type - default Internet protocol type

SYNOPSIS

       /etc/default/inet_type

DESCRIPTION

       The inet_type file defines the default IP protocol to use. Currently this file is only used by the ifconfig(1M) and netstat(1M) commands.

       The  inet_type  file  can  contain  a  number of <variable>=<value> lines. Currently, the only variable defined is DEFAULT_IP, which can be
       assigned a value of IP_VERSION4, IP_VERSION6, or BOTH.

       The output displayed by the ifconfig and netstat commands can be controlled by the value of DEFAULT_IP set in inet_type file.  By  default,
       both commands display the IPv4 and IPv6 information available on the system. The user can choose to suppress display of IPv6 information by
       setting the value of DEFAULT_IP.  The following shows the possible values for DEFAULT_IP and the resulting ifconfig and netstat output that
       will be displayed:

       IP_VERSION4     Displays only IPv4 related information. The output displayed is backward compatible with older versions of the ifconfig(1M)
                       and netstat(1M) commands.

       IP_VERSION6     Displays both IPv4 and IPv6 related information for ifconfig and netstat.

       BOTH            Displays both IPv4 and IPv6 related information for ifconfig and netstat.

       The command-line options to the ifconfig and netstat commands override the effect of DEFAULT_IP as set in the inet_type file. For  example,
       even if the value of DEFAULT_IP is IP_VERSION4, the command

       example% ifconfig -a6

       will display all IPv6 interfaces.

EXAMPLES

       Example 1: Suppressing IPv6 Related Output

       This is what the inet_type file must contain if you want to suppress IPv6 related output:

       DEFAULT_IP=IP_VERSION4

SEE ALSO

       ifconfig(1M), netstat(1M)

SunOS 5.10                                                          16 Jun 1999                                                       inet_type(4)